Medium severity · published Mar 26, 2026
CVE-2026-0964
Libssh: improper sanitation of paths received from scp servers
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
A malicious SCP server can send unexpected paths that could make the
client application override local files outside of working directory.
This could be misused to create malicious executable or configuration
files and make the user execute them under specific consequences.
This is the same issue as in OpenSSH, tracked as CVE-2019-6111.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenShift Container Platform 4 · Red Hat
All versions, or not specified · source: vendor
EL
Enterprise Linux · Redhat
8.0; 9.0; 10.0 · source: NVD
HI
Hardened Images · Redhat
All versions, or not specified · source: NVD
LI
Libssh · Libssh
before 0.11.4 · source: NVD
OC
Openshift Container Platform · Redhat
4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-0964
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-0964
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:18160
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:18683
Mitigation
https://access.redhat.com/security/cve/CVE-2026-0964
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2436979
Release Notes
https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/
More from Red Hat Enterprise Linux 10
7.8
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
7.5
CVE-2026-34486
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
10.0
CVE-2026-46595
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
10.0
CVE-2026-34078
Flatpak has a complete sandbox escape leading to host file access and code execution in the host context
10.0
CVE-2026-4692
Sandbox escape in the Responsive Design Mode component