CVE-2026-59995: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-59995 is a relative path traversal vulnerability in the SFTP client component of OpenSSH before version 10.4. When a user runs sftp server:/path . against an attacker-controlled server, the server can cause downloaded files to be written outside the intended target directory. All OpenSSH versions prior to 10.4 are affected; the fix was introduced in OpenSSH 10.4 (released July 6, 2026). The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) per NVD, or 4.2 (Moderate) per the GitHub Advisory Database (GitHub Advisory, Openwall).

The root cause is improper path constraint enforcement in the SFTP client (CWE-22/CWE-23: Path Traversal / Relative Path Traversal). When a user initiates a bulk download using the sftp server:/path . syntax, the client does not adequately validate or sanitize file paths returned by the server, allowing a malicious server to specify relative path sequences (e.g., ../) that resolve to locations outside the intended download directory. Exploitation requires user interaction — the victim must connect to and initiate a file transfer from an attacker-controlled SFTP server. The issue was identified by the Swival Security Scanner and disclosed alongside the OpenSSH 10.4 release (Openwall, GitHub Advisory).

A successful attack allows an unauthenticated attacker controlling a malicious SFTP server to write files to arbitrary locations on the victim's filesystem, outside the intended download directory. This can result in overwriting legitimate files (availability impact) or placing malicious files in sensitive directories such as ~/.ssh/authorized_keys, shell startup scripts, or cron directories, potentially enabling code execution or privilege escalation. Confidentiality is not directly impacted, but integrity and availability are both affected at a low severity level (GitHub Advisory, Openwall).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable due to the required user interaction. The EPSS score is approximately 0.20–0.24%, placing it in the 15th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Set up a malicious SFTP server: The attacker configures a rogue SFTP server that responds to file listing and download requests with crafted path responses containing relative traversal sequences (e.g., ../../.ssh/authorized_keys).
2. Lure the victim: The attacker social-engineers or redirects the victim into connecting to the malicious server using the vulnerable syntax: sftp attacker-server:/path .
3. Serve malicious file paths: When the victim's SFTP client requests the file listing or initiates the download, the malicious server returns file entries with path traversal sequences in the filename (e.g., ../../../home/user/.ssh/authorized_keys).
4. File written outside intended directory: The OpenSSH SFTP client, failing to properly constrain the download path, writes the attacker-supplied file content to the traversed location on the victim's filesystem.
5. Achieve persistence or code execution: By writing to sensitive locations (e.g., SSH authorized keys, shell rc files, cron jobs), the attacker can establish persistence or trigger code execution on the victim's system (Openwall, GitHub Advisory).

• File System: Unexpected or newly created files in directories outside the intended SFTP download target (e.g., ~/.ssh/authorized_keys, ~/.bashrc, ~/.profile, /etc/cron.d/, /tmp/); modification timestamps on sensitive files coinciding with SFTP session activity.
• Logs: Shell history or audit logs showing sftp commands using the server:/path . syntax against unfamiliar or external hosts; file access logs showing writes to sensitive paths during SFTP sessions.
• Network: Outbound SFTP (TCP port 22) connections to unknown or untrusted external IP addresses initiated by end users; unusual SFTP session durations or large numbers of file transfers from a single external host.

Upgrade OpenSSH to version 10.4 or later, which contains the fix for this vulnerability (Openwall). Ubuntu users should apply the patch provided in USN-8533-1. As a workaround, avoid using the sftp server:/path . bulk download syntax against untrusted or unknown SFTP servers. Apply network segmentation or firewall rules to restrict outbound SFTP connections to known, trusted servers only.

The vulnerability was disclosed as part of the OpenSSH 10.4 release announcement by Damien Miller on the oss-security mailing list on July 6, 2026, crediting the Swival Security Scanner for discovery (Openwall). Red Hat filed a Bugzilla entry and rated the issue as medium severity (Red Hat Bugzilla). Security news outlets including SecurityOnline.info covered the OpenSSH 10.4 security fixes, and the vulnerability was tracked by threat intelligence platforms including Tenable Nessus (plugin 325689) and Hawk-Eye weekly threat digests.