CVE-2026-59995

CVE-2026-59995 is a path traversal vulnerability found in the `sftp` client of OpenSSH versions prior to 10.4. This flaw arises when a user employs the command "sftp server:/path ." to download files from an attacker-controlled server. The `sftp` client, in this scenario, does not adequately restrict the destination of the downloaded files. This inadequate constraint allows a malicious server to influence the local file operations on the client's system. By exploiting this, an attacker could potentially specify arbitrary local file system locations for downloaded content, leading to the overwriting of critical system files or the placement of malicious payloads in privileged directories.