Symlink Vulnerability in SSHFS Network Filesystem Client

CVE-2026-47187

What is CVE-2026-47187?

SSHFS, a network filesystem client for SSH servers, has a vulnerability that allows a rogue SFTP server to return absolute or relative symlink targets. This can lead to local file exposure or overwriting local files if the client follows the links during normal operations like copying or editing files. The flaw stems from the failure to properly mitigate relative symlink targets in versions prior to 3.7.6, allowing attackers to manipulate and potentially disclose sensitive local data.

References