CVE-2026-48711: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-48711 is an argument injection vulnerability (CWE-88) in SSHFS, a network filesystem client for connecting to SSH servers. It affects all versions from 1.4 through 3.7.5, and was discovered and disclosed by researcher abhinavagarwal07 on May 29, 2026, with a fix released the same day in version 3.7.6. The flaw allows an attacker who controls the mount source argument passed to SSHFS to inject SSH options — including ProxyCommand — leading to arbitrary local command execution. It carries a CVSS v3.1 base score of 7.0 (High) (GitHub Advisory, Feedly).

The root cause is improper neutralization of argument delimiters (CWE-88) in SSHFS's mount source parsing. SSHFS accepts bracketed mount sources (e.g., [-oProxyCommand=CMD]:/path) because they begin with [, not -, bypassing the initial option-check. The find_base_path() function then strips the brackets, leaving -oProxyCommand=CMD as the value of sshfs.host, which is subsequently passed directly to ssh as a command-line argument without validation or an end-of-options guard (--). When the caller also supplies a path-valued sftp_server (e.g., /usr/lib/openssh/sftp-server), ssh interprets the injected string as an option and the server path as the destination, causing the ProxyCommand to execute locally before any SSH connection or authentication occurs. A public proof-of-concept was included in the GitHub Security Advisory (GitHub Advisory, Fix Commit).

Successful exploitation results in arbitrary local command execution as the user running SSHFS, with full confidentiality, integrity, and availability impact on the affected system. No SSH authentication is required because the injected ProxyCommand executes before any connection attempt is made. The attack is constrained to scenarios where a caller or wrapper script passes attacker-controlled input as the SSHFS mount source and uses a path-valued sftp_server configuration, limiting the scope but making it particularly dangerous in automated or multi-user environments that wrap SSHFS (GitHub Advisory).

A proof-of-concept exploit was publicly disclosed alongside the advisory on May 29, 2026, and was confirmed tested on Ubuntu 24.04 with sshfs 3.7.3 and OpenSSH 9.6p1. The NVD SSVC assessment classifies exploitation as "poc" with non-automatable attack and total technical impact. The EPSS score is approximately 0.021% (very low probability of widespread exploitation in the near term), and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution or in-the-wild exploitation has been reported (GitHub Advisory, Feedly).

1. Identify a vulnerable wrapper: Locate a script or application that invokes sshfs with a path-valued sftp_server option (e.g., -o sftp_server=/usr/lib/openssh/sftp-server) and passes user-controlled input as the mount source argument.
2. Craft the malicious mount source: Construct a bracketed mount source string embedding the desired SSH option, e.g., '[-oProxyCommand=sh -c "id > /tmp/sshfs-pwned"]:/path'. The brackets cause SSHFS to accept the string as a valid host specification.
3. Pass the payload to the wrapper: Supply the crafted string as the mount source to the vulnerable wrapper: ./vulnerable-wrapper.sh '[-oProxyCommand=sh -c "id > /tmp/sshfs-pwned"]:/path'.
4. Trigger argument injection: SSHFS's find_base_path() strips the brackets, leaving -oProxyCommand=sh -c "id > /tmp/sshfs-pwned" as sshfs.host. This is appended to the ssh argv without a -- guard.
5. ProxyCommand executes locally: With the path-valued sftp_server providing a positional destination argument, ssh parses the injected string as an option and executes the ProxyCommand locally as the user running SSHFS — before any connection or authentication attempt.
6. Verify execution: Confirm arbitrary command execution by checking the output file (e.g., cat /tmp/sshfs-pwned showing the user's uid/gid) (GitHub Advisory).

• Process: Unexpected child processes spawned by sshfs or ssh (e.g., /bin/sh, bash, curl, wget, python) that are not consistent with normal SFTP subsystem activity.
• File System: Unexpected files created in world-writable directories (e.g., /tmp/) by the user running SSHFS; new cron jobs, scripts, or binaries written by the SSHFS process user.
• Logs: System logs (e.g., auth.log, syslog) showing ssh invocations with arguments containing -oProxyCommand= or other injected options; SSHFS stderr output containing invalid hostname (on patched versions, indicating a blocked attempt).
• Network: Unexpected outbound connections from the host running SSHFS to attacker-controlled infrastructure, initiated by a process spawned from the SSHFS/SSH process tree (GitHub Advisory).

Upgrade SSHFS to version 3.7.6 or later, which rejects any hostname beginning with - after bracket normalization and adds a -- end-of-options guard before the hostname in the ssh argument list (SSHFS Release, Fix Commit). As a workaround where upgrading is not immediately possible, wrapper scripts and applications should validate and sanitize the mount source argument before passing it to SSHFS, rejecting any input that begins with [ or -. Additionally, avoid using path-valued sftp_server configurations unless strictly necessary, as this configuration is required for the exploit to succeed (GitHub Advisory).

The vulnerability was disclosed via the oss-security mailing list shortly after the advisory was published, generating community awareness among Linux and open-source security practitioners (oss-sec). The Solus Linux project and openSUSE Tumbleweed both referenced the fix in their update announcements, indicating prompt downstream patching activity. Debian also issued a security update addressing the vulnerability. Security scanning vendors Tenable (Nessus) and Qualys added detection plugins shortly after disclosure, reflecting standard industry response to a high-severity open-source vulnerability.