CVE-2026-106552

A flaw was found in OpenSSH. A malicious or compromised server can write files to unintended locations on a client system during a recursive copy operation using the SFTP (Secure File Transfer Protocol) client. By returning crafted file paths, the remote server can trigger a directory traversal and force the client to store files outside the designated destination directory, potentially overwriting existing local files.

A flaw was found in the OpenSSH sftp client, rated moderate severity by Red Hat Product Security. When a user performs a recursive copy operation from a malicious or compromised SFTP server, the server can return crafted file paths that trigger a directory traversal, causing the sftp client to write files outside the designated destination directory on the local system and potentially overwrite existing files writable by the user running the client. The impact is limited to the integrity and availability of files accessible to the local user: the flaw does not disclose information (confidentiality impact is none) and does not grant privileges beyond those of the local user. Exploitation requires a user to initiate a recursive copy against an attacker-controlled server, which is reflected in Red Hat's CVSS 3.1 score of 4.2 (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L); this is lower than the NIST score of 6.5 mainly because Red Hat assesses high attack complexity and low integrity and availability impacts bounded by the local user's file permissions, whereas NIST rates attack complexity as low and integrity impact as high. Within Red Hat, this flaw affects the openssh component in Red Hat Hardened Images; the fix is being pursued through the delegated Red Hat Hardened Images update process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.