CVE-2026-47187 SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write
A rogue SFTP server can exploit symlink handling in SSHFS to read or write arbitrary local files on the client system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-47187?
CVE-2026-47187 is a critical path traversal vulnerability in libfuse sshfs, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local filesystem. The documented transform_symlinks mitigation does not contain relative targets because transform_symlink() returns early at sshfs.c:2181, while sshfs_readlink() at sshfs.c:2234 to sshfs.c:2236 otherwise copies the server-supplied link target to the kernel. A victim or victim-side tool that follows such a link through ordinary operations such as cp, rsync, backup tooling, or an editor can disclose readable local files back to the server or write server-controlled content to writable local files, potentially including startup or scheduled-task files. This issue is fixed in version 3.7.6.
Weakness: CWE-59
Which versions are affected by CVE-2026-47187?
How do I fix CVE-2026-47187?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-47187 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47187 exists.
Sources
Also known as ALPINE-CVE-2026-47187, AZL-97011, DEBIAN-CVE-2026-47187, GHSA-pjv6-2c3f-r357, UBUNTU-CVE-2026-47187.