CVE-2026-106552

A flaw was found in the OpenSSH sftp client, rated moderate severity by Red Hat Product Security. When a user performs a recursive copy operation from a malicious or compromised SFTP server, the server can return crafted file paths that trigger a directory traversal, causing the sftp client to write files outside the designated destination directory on the local system and potentially overwrite existing files writable by the user running the client. The impact is limited to the integrity and availability of files accessible to the local user: the flaw does not disclose information (confidentiality impact is none) and does not grant privileges beyond those of the local user. Exploitation requires a user to initiate a recursive copy against an attacker-controlled server, which is reflected in Red Hat's CVSS 3.1 score of 4.2 (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L); this is lower than the NIST score of 6.5 mainly because Red Hat assesses high attack complexity and low integrity and availability impacts bounded by the local user's file permissions, whereas NIST rates attack complexity as low and integrity impact as high. Within Red Hat, this flaw affects the openssh component in Red Hat Hardened Images; the fix is being pursued through the delegated Red Hat Hardened Images update process.