CVE-2026-106552 in OpenSSH
Summary
by MITRE • 10/07/2026
In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in OpenSSH versions prior to 10.6 represents a critical security flaw within the Secure File Transfer Protocol subsystem, specifically affecting the sftp-server component when handling recursive directory operations. This issue stems from an insufficient validation of path components during file transfer requests, allowing a malicious or compromised server to manipulate the destination paths provided by clients. When a client initiates a recursive copy operation, such as using the scp-style command within SFTP sessions, the server processes these instructions without adequately sanitizing relative path references like dot-dot sequences. This lack of rigorous boundary checking enables an attacker to break out of the intended directory confinement, leading to arbitrary file writes on the host system where the SSH daemon is executing with elevated privileges or access to sensitive directories outside the user's home space.
From a technical perspective, this flaw aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as directory traversal. The root cause lies in the parsing logic that resolves relative paths against the current working directory without enforcing strict canonicalization or chroot constraints effectively during recursive operations. In standard SFTP implementations, clients are expected to operate within their designated home directories or specified jail environments. However, by exploiting this weakness, an adversary can construct a sequence of path manipulations that bypass these restrictions. The vulnerability is particularly dangerous because it occurs during routine administrative tasks like bulk file transfers, which often require higher levels of trust and access rights than simple interactive shell sessions.
The operational impact of this vulnerability is severe, as it allows for unauthorized data exfiltration or the injection of malicious files into critical system locations. An attacker who controls a compromised SSH server can leverage this flaw to write configuration files, scripts, or binaries into directories such as /etc, /usr/bin, or other sensitive areas depending on the privileges under which sshd is running. This capability facilitates privilege escalation if combined with other local vulnerabilities, enables persistence mechanisms through backdoor installation, and compromises data integrity by overwriting legitimate system files. Furthermore, in environments where SSH keys are stored in user directories that might be inadvertently overwritten, this could lead to authentication bypasses or further lateral movement within the network infrastructure.
This behavior is also indicative of weaknesses related to CWE-78: Improper Neutralization of Special Elements used in an OS Command if the underlying implementation relies on shell interpretation for path resolution, though primarily it remains a file system access control failure. In terms of threat modeling and adversary tactics, this vulnerability supports techniques associated with ATT&CK ID T1530: Data from Cloud or Storage Service, specifically when attackers use compromised servers to exfiltrate data by tricking clients into uploading files to attacker-controlled locations that are then retrieved via other means, or more directly, it aligns with lateral movement and persistence strategies where malicious artifacts are placed in accessible directories for subsequent execution.
Mitigation requires immediate upgrading of OpenSSH to version 10.6 or later, which includes patches addressing the path validation logic during recursive operations. Organizations should also implement strict chroot jails for SFTP-only users to limit the filesystem scope regardless of application-level flaws. Additionally, deploying file integrity monitoring solutions can help detect unauthorized changes in critical directories resulting from such exploitation attempts. Security teams must ensure that SSH configurations adhere to least privilege principles and regularly audit server-side scripts or automation tools that interact with SFTP services to prevent abuse through automated recursive transfers.