CVE-2026-0964 Libssh: improper sanitation of paths received from scp servers
A malicious SCP server can send crafted paths to override local files outside the working directory, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-0964?
CVE-2026-0964 is a medium-severity path traversal vulnerability in Redhat Enterprise Linux, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences.
This is the same issue as in OpenSSH, tracked as CVE-2019-6111.
Weakness: CWE-22
Which versions are affected by CVE-2026-0964?
It affects 4 products.
Products include Libssh Libssh, Redhat Enterprise Linux, Redhat Hardened Images, Redhat Openshift Container Platform.
How do I fix CVE-2026-0964?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-0964 being exploited?
There is no known exploitation of CVE-2026-0964 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2026-59851 Libssh: libssh: authentication bypass via missing gssapi principal check
- CVE-2025-5987 Libssh: invalid return code for chacha20 poly1305 with openssl backend
- CVE-2025-14821 Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows
- CVE-2012-4560 Memory corruption in n/a
- CVE-2012-4562 Integer overflow in n/a
Sources
Also known as AZL-81098, BELL-CVE-2026-0964, CLSA-2026-1778237316, CLSA-2026-1778269628, DEBIAN-CVE-2026-0964, ECHO-e22e-7dc5-9540 and 4 more.