Path Traversal Vulnerability in OpenSSH Affecting File Transfer Operations
CVE-2026-110923

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
15 October 2026

What is CVE-2026-110923?

A vulnerability exists in OpenSSH that allows a malicious server to exploit the SFTP file transfer process. An attacker can send an empty filename, a slash-only path, or a '..' basename, resulting in files being written outside the designated directory chosen by the user. This behavior can lead to unauthorized file access and potential data breaches if users are not cautious during file transfers.

References

https://access.redhat.com/security/cve/CVE-2026-110923
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2553028
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Junghoon Cho for reporting this issue.
.