CVE-2026-47187: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-47187 is a symlink escape vulnerability in SSHFS (a FUSE-based network filesystem client) that allows a rogue SFTP server to induce arbitrary local file reads and writes on the client system. Affecting all versions prior to 3.7.6, the flaw was discovered and disclosed on May 29, 2026, with the CVE formally published on August 19, 2026. The vulnerability carries a CVSS v3.1 base score of 9.3 (Critical) (GitHub Advisory, Feedly).

The root cause is improper link resolution before file access (CWE-59): SSHFS passes server-supplied symlink targets verbatim to the kernel via FUSE without adequate validation. Specifically, sshfs_readlink() at sshfs.c:2234–2236 copies the server-provided link target directly to the kernel, while the existing transform_symlinks mitigation is ineffective against relative targets because transform_symlink() returns early at sshfs.c:2181 when either the link or base path is not absolute. This allows a malicious SFTP server to return absolute symlink targets (e.g., /etc/passwd) or relative traversal targets (e.g., ../../../tmp/secret) that the client kernel VFS resolves against the local filesystem. A proof-of-concept was included in the security advisory, demonstrating both file exfiltration and write primitives using ordinary cp operations (GitHub Advisory, Fix Commit).

A successful attack allows an attacker controlling a malicious SFTP server to read any local file accessible to the mounting user (high confidentiality impact) and write attacker-controlled content to any writable local file (high integrity impact), with no availability impact. The scope is changed because the vulnerability crosses from the remote SFTP namespace into the client's local filesystem namespace. If the attacker writes to shell startup files, cron entries, or other scheduled-task files, this can escalate to arbitrary code execution on the client system (GitHub Advisory, Feedly).

A proof-of-concept exploit was included in the original security advisory, demonstrated on sshfs 3.7.3 running on Ubuntu 24.04 with kernel 6.17.0, confirming both file read and write primitives via ordinary cp operations. The NVD SSVC assessment classifies exploitation as "poc" and not automatable, requiring user interaction (a victim must perform a file operation that follows the server-provided symlink). No evidence of in-the-wild exploitation has been observed, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.031% (GitHub Advisory, Feedly).

1. Set up a rogue SFTP server: The attacker deploys a malicious SFTP server (e.g., using the Python PoC from the advisory) that responds to READLINK requests with crafted symlink targets — either absolute paths like /etc/passwd or relative traversal paths like ../../../tmp/victim-secret.
2. Induce victim to mount: The attacker convinces a victim to mount the rogue server using sshfs (e.g., sshfs -o directport=9999 127.0.0.1:/ /tmp/mnt), or exploits a compromised/unverified SSH host key to intercept a legitimate mount.
3. Trigger symlink resolution via normal file operations: The victim (or an automated tool such as cp, rsync, a backup agent, or an editor) performs a file operation on the mount point that follows a symlink — for example: cp /tmp/mnt/poc/leak /tmp/mnt/poc/capture.
4. Exfiltrate local files: The kernel resolves the server-supplied symlink target against the local filesystem, reading the local file. The contents are then written back to the server via SSH_FXP_WRITE when the victim copies the file to a server-writable path.
5. Write attacker-controlled content: The attacker serves a payload on one path and a symlink to a writable local file (e.g., ~/.bashrc or a cron file) on another. When the victim copies between them, the kernel follows the symlink and writes attacker bytes to the local file, potentially achieving code execution (GitHub Advisory).

• Network: Unexpected outbound SFTP/SSH connections from client systems to unknown or unverified servers; SFTP READLINK responses containing absolute paths (starting with /) or .. components in server logs.
• File System: Unexpected modifications to shell startup files (~/.bashrc, ~/.profile, /etc/cron*), scheduled task files, or other sensitive local files coinciding with an active sshfs mount; new or modified files in locations that should not be writable via the mount.
• Logs: SFTP server logs showing READLINK responses with escape patterns such as /tmp/, /etc/, or ../../../; sshfs mount activity in system logs (/var/log/syslog, journalctl) followed by unexpected file I/O.
• Process: Processes such as cp, rsync, or backup tools operating on sshfs mount points and generating unexpected file access to sensitive local paths; fusermount or sshfs processes connected to unrecognized remote hosts (GitHub Advisory).

Upgrade to sshfs version 3.7.6 or later, which introduces the -o contain_symlinks option (enabled by default) that rejects symlink targets that are absolute or contain .. components, returning EPERM for blocked symlinks (sshfs Release). Users who cannot upgrade immediately should avoid mounting untrusted or unverified SFTP servers, and should ensure SSH host key verification is strictly enforced to prevent man-in-the-middle attacks. Note that the existing -o transform_symlinks option does not mitigate this vulnerability for relative traversal targets and should not be relied upon as a workaround. Users who require legacy symlink pass-through for trusted servers after upgrading can opt out with -o no_contain_symlinks, but this should only be used with fully trusted servers (Fix Commit, GitHub PR).

The vulnerability was disclosed via the oss-security mailing list and received attention from the security community on Mastodon and other social platforms shortly after publication (oss-sec). Tenable published Nessus detection plugins (IDs 318050 and 320416) for the vulnerability, and it was picked up by security news outlets including SecurityOnline. Downstream Linux distributions including Debian and openSUSE Tumbleweed issued updates incorporating the fix, with Debian announcing the update in July 2026 (Debian News).