CVE-2026-106552: OpenSSH sftp directory traversal during recursive copy

CVE-2026-106552 · Severity: medium · CVSS 4.2 · Published 2026-10-06

OpenSSH includes an SFTP client used for secure file transfers. A malicious SFTP server can trick the client into writing files outside the intended target directory during recursive copy operations, allowing an attacker to overwrite arbitrary files on the victim's system.

Technologies: OpenSSH. Vendors: OpenSSH.

Quick answers

Is CVE-2026-106552 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-106552 being exploited in the wild.
How severe is CVE-2026-106552?
Medium severity, with a CVSS score of 4.2, published 6 October 2026.
Which products and versions are affected?
OpenSSH before 10.6.
Is there a fix for CVE-2026-106552?
Yes: fixed in OpenSSH 10.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106552 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-106552?
Check whether you run OpenSSH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: OpenSSH 10.6

Technical details

A path validation vulnerability in sftp(1) allows a server to return specially crafted paths that bypass restrictions on recursive copy operations. The flaw enables directory traversal attacks where files are written to unintended locations on the client. The fix adds stricter validation of paths returned from the server.

Affected products

  • OpenSSH OpenSSH before 10.6

Timeline

  • 2026-10-06: disclosed
  • 2026-10-06: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.