Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
OpenSSH may store file in wrong folder when copying remotely
published 4 months ago
Summary
The OpenSSH package used in Azure can put a copied file into the parent directory instead of the target directory when transferring between two remote machines. This could lead to files being misplaced or overwritten, potentially causing data loss or exposure. Upgrade OpenSSH to version 9.8p1-9 or later to prevent this behavior.
What to do
- Update azure openssh to version 9.8p1-9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | openssh |
< 9.8p1-9 Fix: upgrade to 9.8p1-9
|
Original advisory text
CVE-2026-59996 affecting package openssh for versions less than 9.8p1-9
scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.
References
Timeline
Published8 Jul 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-92039 · OSV
Track software like this
Free during beta