CVE-2019-6111 Path traversal in n/a

Medium 5.9 Published 31 Jan 2019 Updated 14 Oct 2026

A malicious scp server can overwrite arbitrary files on the client, potentially leading to privilege escalation via authorized_keys manipulation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-6111?

CVE-2019-6111 is a medium-severity path traversal vulnerability in Canonical Ubuntu Linux, published on 31 Jan 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).

Weakness: CWE-22

Which versions are affected by CVE-2019-6111?

It affects 19 products.

Products include Apache Mina Sshd, Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Freebsd Freebsd, Fujitsu M10-1 Firmware and 13 more.

How do I fix CVE-2019-6111?

Apply the vendor's patch.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2019-6111 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-6111 exists.

Public exploit code: 2 Exploit-DB entries and 2 proofs of concept on GitHub.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2019-6111, DEBIAN-CVE-2019-6111, DSA-4387-2, GHSA-jr78-hfw4-xp7g, UBUNTU-CVE-2019-6111, USN-3885-2.