CVE-2026-0964
mediumA malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory.
Vendor / product: Libssh — libssh
A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue as in OpenSSH, tracked as CVE-2019-6111.
CVSS
6.3
6.3 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-03-26 21:17
Modified: 2026-11-05 17:17
NVD status: Modified
Last synced 9 hours ago
Verified against the source API 2026-11-05 17:18 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
libssh / libssh <0.11.4
redhat / hardened_images all versions
redhat / openshift_container_platform 4.0
redhat / enterprise_linux 8.0, 9.0, 10.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://access.redhat.com/security/cve/CVE-2026-0964
Vendor advisory: https://bugzilla.redhat.com/show_bug.cgi?id=2436979
Patch / mitigation: https://access.redhat.com/security/cve/CVE-2026-0964
References
- https://access.redhat.com/errata/RHSA-2026:18160 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2026:18683 secalert@redhat.com
- https://access.redhat.com/security/cve/CVE-2026-0964 secalert@redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2436979 secalert@redhat.com
- https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/ secalert@redhat.com
Data sources
NVD CVE API 2.0 — fetched 2026-11-05 17:18 UTC · record ↗