CVE-2026-48711
Description
A flaw was found in SSHFS, a network filesystem client. An attacker can exploit this vulnerability by providing a specially crafted mount source that includes argument delimiters. This improper handling of the mount source allows for argument injection, leading to the execution of arbitrary commands on the system as the user running SSHFS. This occurs before any connection or authentication, posing a significant security risk.
Statement
A flaw was found in SSHFS, a network filesystem client for connecting to SSH servers. SSHFS accepts a bracketed mount source such as [-oProxyCommand=CMD]:/path and removes the brackets during parsing, leaving a host value that begins with a dash. This value is passed directly to ssh as a command-line argument, causing ssh to interpret it as an option rather than a hostname. When combined with a path-valued sftp_server configuration, this allows an attacker who can control the mount source parameter to inject a ProxyCommand that executes arbitrary local commands as the user running SSHFS, before any SSH connection or authentication occurs. This vulnerability affects applications or wrappers that pass untrusted input as the sshfs mount source.
Mitigation
Update fuse-sshfs to version 3.7.6 or later. As a workaround, ensure that mount source parameters passed to sshfs come only from trusted sources and validate input to reject mount sources beginning with brackets or dashes. Applications wrapping sshfs should implement strict input validation before invoking the command.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | 7 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Other
Technical Impact: Execute Unauthorized Code or Commands; Alter Execution Logic; Read Application Data; Modify Application Data
An attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified or could cause other unintended behavior.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
