Skip to content
Threat Feed
Subscribe

Product

OpenSSH Sftp < 10.4

1 brief RSS
medium threat

CVE-2026-59995: OpenSSH SFTP Arbitrary File Placement Vulnerability

CVE-2026-59995 describes a vulnerability in the OpenSSH sftp client, specifically versions before 10.4, that allows an attacker to control the location of downloaded files when a user executes 'sftp server:/path .' against an attacker-controlled server, potentially leading to arbitrary file placement and subsequent system compromise.

exploited OpenSSH sftp < 10.4 vulnerability client-side arbitrary-file-placement openssh sftp
1c