CVE-2026-110923— Openssh: openssh: sftp can write outside the destination directory from a server-supplied path
Quick assessment
Affected
Red Hat Red Hat Hardened Images
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenSSH 中发现了一个漏洞。在通过 SFTP 进行文件拷贝时，恶意服务器可以提供一个空文件名、仅包含斜杠的路径，或者以“..”为基名的路径，SFTP 会将其作为本地目标路径，从而导致文件被写入到用户所选目录之外的位置。
Possible ATT&CK Techniques 1 AI
T1565.001 · Stored Data ManipulationAffected Version Matrix 9
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 6 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 9 | any |
affected |
| Red Hat | Red Hat Hardened Images | 10.5p1-1.2.hum1< * |
unaffected |
any |
unaffected | ||
| Red Hat | Red Hat OpenShift Container Platform 4 | any |
affected |
any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110923
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Openssh: openssh: sftp can write outside the destination directory from a server-supplied path
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Hardened Images | 10.5p1-1.2.hum1 ~ * |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
II. Public POCs for CVE-2026-110923
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110923
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-110923 (2)
Other References for CVE-2026-110923 (1)
Same Patch Batch · Red Hat · 2026-10-15 · 9 CVEs total
| CVE-2026-85634 | 8.8 HIGH | Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in |
| CVE-2026-92982 | 8.5 HIGH | Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 te |
| CVE-2026-108334 | 7.4 HIGH | Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-ope |
| CVE-2026-109131 | 5.4 MEDIUM | Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection modu |
| CVE-2026-110925 | 5.4 MEDIUM | Openssh: openssh: '$' and '\' in a command-line username expand through %u |
| CVE-2026-110926 | 5.3 MEDIUM | Openssh: openssh: shared lz77 compression dictionary leaks plaintext across channels |
| CVE-2026-110924 | 4.8 MEDIUM | Openssh: openssh: gssapi delegated credentials can be stored after a failed authentication |
| CVE-2026-110927 | 4.3 MEDIUM | Openssh: openssh: a compressed payload can expand past the maximum packet size |
IV. Related Vulnerabilities
Same product: Red Hat Hardened Images
-
CVE-2026-110927
Openssh: openssh: a compressed payload can expand past the m -
CVE-2026-110926
Openssh: openssh: shared lz77 compression dictionary leaks p -
CVE-2026-110925
Openssh: openssh: '$' and '\' in a command-line username exp -
CVE-2026-88842
Busybox: busybox: dpkg stale field_start pointer causes out- -
CVE-2026-88829
Busybox: busybox: http request smuggling via pipelined reque
Same vendor: Red Hat
-
CVE-2026-109131
Ansible-ui: ansible-ui: stored xss via unsafe javascript url -
CVE-2026-108334
Github.com/kuadrant/kuadrant-operator/internal/wasm: github. -
CVE-2026-85634
Wildfly-core: wildfly-core: deployer rbac role privilege esc -
CVE-2026-92982
Ansible-operator-plugins: ansible operator plugins: arbitrar -
CVE-2026-110927
Openssh: openssh: a compressed payload can expand past the m
Same weakness: CWE-22
-
CVE-2026-108452
Microsoft Office SharePoint Remote Code Execution Vulnerabil -
CVE-2026-111170
kedro-datasets 9.3.0 through 9.6.0 Path Traversal via Matplo -
CVE-2026-57496
NetLicensing MCP Server: REST Path Traversal Bypasses Token -
CVE-2026-61702
OpenPrinting CUPS: root-side banner file disclosure -
CVE-2026-62679
Lychee: Path traversal in `SecurePathController` allows auth
V. Comments for CVE-2026-110923
No comments yet