Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
OpenSSH SFTP may write files to wrong locations
published 29 days ago
Summary
The OpenSSH SFTP server (versions before 10.6) can be tricked during a recursive copy into placing files in directories it shouldn’t. This could let an attacker cause data to be saved outside the intended folder, potentially overwriting or exposing information. Update OpenSSH to version 10.6 or later, or apply any available patches, to stop this behavior.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | openssh | <= 9.8p1-10 |
Original advisory text
CVE-2026-106552 affecting package openssh 9.8p1-10
In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.
References
Timeline
Published6 Oct 2026
Updated7 Oct 2026
First seen7 Oct 2026
Sources
AZL-106700 · OSV
Track software like this
Free during beta