CVE-2026-110923

Executive Summary

CVE-2026-110923 is a path traversal flaw (CWE-22) in OpenSSH's sftp client: during a recursive copy operation, a malicious or compromised SFTP server can supply a crafted remote filename — an empty name, a slash-only path, or a .. basename — that the client uses as the local destination path, causing files to be written outside the directory the user selected. The vulnerability requires user interaction (the victim must initiate a copy from the hostile server), but successful exploitation yields high integrity impact: attacker-controlled file placement anywhere the client user can write. No public exploit, no Nuclei template, no vendor patch, and no CISA KEV listing currently exist, leaving the client population exposed to a confirmed design flaw with a CVSS base score of 6.5.

Technical Analysis

The vulnerability resides in the client-side path handling logic of the OpenSSH sftp utility. The SFTP protocol is a client-server file transfer protocol in which the server dictates the names of directory entries returned during directory listing and READDIR/name resolution operations. The client is responsible for sanitizing those server-supplied names before using them as components of a local filesystem path.

CVE-2026-110923 concerns the moment the client constructs the local destination during a copy (for example, a recursive download of a remote directory into a user-selected local folder). The NVD description states three distinct classes of malicious server input:

• An empty name — a directory entry or path component with no characters, which can collapse a path component and alter the resolved destination.
• A slash-only path — a component consisting solely of /, which can force the client to treat the value as an absolute path or as a path separator rather than a single filename component, escaping the user-selected directory.
• A .. basename — a final path component that resolves to the parent directory, allowing upward traversal relative to the selected directory.

In each case, the client uses the server-supplied string as the local destination path without adequate normalization, canonicalization, or confinement to the user-chosen base directory. The result is a classic path traversal (CWE-22): the write target is computed from untrusted server data rather than being safely joined and constrained beneath the intended destination.

Key characteristics of this flaw, derivable directly from the description:

• Trust boundary: the SFTP server is untrusted in this scenario; the client must not trust server-provided filenames as safe local path components.
• Trigger condition: the user must be performing an sftp copy (i.e., a transfer whose destination is on the local filesystem) from the malicious server.
• Write primitive: attacker-influenced file placement outside the selected directory. The integrity impact is high (I:H); confidentiality and availability are not impacted per the CVSS vector (C:N/A:N).
• Fix domain: the correct resolution is strict validation and confinement of server-supplied names — rejecting empty components, rejecting absolute/slash-only paths, rejecting .. traversal, and canonicalizing the final path to ensure it remains within the user-selected directory.

The CVSS v3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N indicates a network-reachable attack (the client connects to a remote server), low attack complexity, no privileges required on the server side to deliver the malicious names, and required user interaction (the victim must run the copy). Scope is unchanged and only integrity is affected.

Technical details not available: the advisory data provided does not name specific functions, file paths, or code commits within the OpenSSH source tree, nor does it specify affected version numbers, platforms, or an upstream fix. Any claim of a particular function (e.g., a specific sftp command handler) or a specific release range would be speculative and is therefore deliberately omitted.

Exploitation Scenarios

The attack chain is inferred from the vulnerability class described in the NVD text. No public PoC or exploit code is available; no Nuclei template exists. The following scenario stays at the mechanism level and does not invent implementation details.

1. Reconnaissance / target identification. The attacker positions themselves to be the SFTP server the victim connects to. This can be achieved by operating a malicious SFTP server, by compromising or impersonating a legitimate mirror/host, by DNS or host key substitution where the client does not strictly verify host identity, or by social engineering the victim into connecting to an attacker-controlled host. The attack surface is the SSH/SFTP service the victim initiates a session against.

2. Triggering the flaw. The attacker's SFTP server responds to directory listing / path resolution requests with crafted entry names — specifically an empty name, a slash-only (/) path, or a .. basename — presented as the names of files or directories the victim is copying. These names are returned through the normal protocol response path and are the only malicious input required. No server-side privilege is needed beyond controlling the protocol responses (PR:N).

3. Payload / execution mechanism (class level). When the user performs the copy (UI:R — user interaction required), the client concatenates or resolves the server-supplied name against the local destination. Because the name is not properly constrained, the resolved local path escapes the user-selected directory. The client then writes the transferred content to that attacker-chosen location — outside the intended folder. The "payload" in this class of attack is file placement itself: the attacker controls where a file lands, and by extension what filename is used at the destination.

4. Post-exploitation impact. Writing outside the selected directory enables high-integrity attacks short of code execution by themselves. Depending on the target user's filesystem permissions and what the destination path reaches, the attacker can attempt to overwrite or plant files at paths the user can write to — for example configuration, startup, or shortcut locations that a subsequent process or the user may consume. Because the CVSS vector shows C:N and A:N, the advisory characterizes this as a placement/integrity issue rather than direct data disclosure or denial of service; any escalation to code execution would depend on environment-specific consumption of the misplaced file and is not asserted by the CVE data.

Caveat: No public proof-of-concept exists; the specific file paths, overwrite targets, and any chained code-execution outcomes are environment-dependent and are not described in the source data. The above reflects the vulnerability class only.

Impact Assessment

• Confidentiality (C:N): None — the flaw concerns destination write/placement, not exfiltration.
• Integrity (I:H): High — server-controlled filenames cause local writes outside the selected directory, allowing file placement/overwrite at attacker-chosen paths reachable by the client user.
• Availability (A:N): None per the vector.
• Attack Vector (AV:N): Network — the client connects to a remote SFTP server.
• Attack Complexity (AC:L): Low — only crafted protocol names are required.
• Privileges Required (PR:N): None on the server side beyond serving responses.
• User Interaction (UI:R): Required — the victim must initiate an sftp copy.
• Scope (S:U): Unchanged.

Affected population: any deployment where users run the OpenSSH sftp client to copy files from a server not fully trusted — mirror downloads, automated fetch jobs against third-party hosts, and interactive transfers from untrusted or compromised endpoints.

Blast radius / business impact: the practical severity hinges on the client user's write permissions and the sensitivity of filesystem locations the traversal can reach. Worst-case, attacker-chosen file placement can seed follow-on compromise (e.g., planting files that another process trusts), but escalation is environment-specific. Given CVSS 6.5, this is a medium-severity issue with notable integrity consequences and a strong prerequisite (user-initiated copy from a hostile server). No EPSS score has been assigned by FIRST.org as of this writing, so probabilistic exploitation likelihood cannot be cited.

Detection Guidance

Sigma Rule

title: Suspicious SFTP Client Path Traversal Artifact (CVE-2026-110923)
id: 3f1c2a90-7d54-4b2e-9c11-110923000001
status: experimental
description: Detects sftp client processes writing files whose paths traverse outside expected destination directories, consistent with CVE-2026-110923.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110923
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/sftp'
  selection_args_traversal:
    CommandLine|contains:
      - '..'
      - '//'
  condition: selection_proc and selection_args_traversal
falsepositives:
  - Legitimate use of relative paths in interactive sftp sessions
level: low
tags:
  - attack.t1565.001
  - cve.2026.110923

YARA Rule

rule CVE_2026_110923_SFTP_PathTraversal
{
    meta:
        description = "Heuristic indicator for SFTP batch/session data referencing traversal-style destination names (CVE-2026-110923)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110923"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $sftp = "sftp" ascii nocase
        $dotdot = ".." ascii
        $slash = "/" ascii

    condition:
        $sftp and $dotdot and #slash > 1
}

Suricata IDS Rule

alert tcp any any -> any 22 (msg:"CVE-2026-110923 OpenSSH sftp client path traversal - suspicious SFTP name with traversal component"; flow:established,to_client; content:"|00 00 00|"; depth:4; content:".."; within:128; classtype:attempted-user; reference:cve,2026-110923; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-110923; metadata:created_at 2026_01_01; sid:2026110923; rev:1;)

Note: SFTP rides inside an encrypted SSH channel; this signature can only inspect plaintext SFTP streams where SSH is terminated by an inspection proxy. In end-to-end encrypted sessions, host-based detection (Sigma/auditd) is the primary control.

Elastic Detection

process where event.type == "start" and process.name == "sftp" and
  process.args : "*..*" and process.args : "*/"

This EQL surfaces sftp client invocations whose arguments contain both a parent-directory token and a slash, warranting review for traversal-driven destination paths during a copy operation.

Splunk SPL Query

index=endpoint (process_name=sftp OR process_name=scp)
| where match(command_line, "\.\.")
| rex field=command_line "(?<dest>[^ ]+)$"
| table _time host user process_name command_line dest
| sort - _time

Correlate with file-integrity monitoring or auditd write events to confirm writes landing outside the intended destination directory.

Wazuh OSSEC Rule

<group name="openssh,cve-2026-110923,">
  <rule id="1109230" level="8">
    <decoded_as>json</decoded_as>
    <field name="process.name">sftp</field>
    <field name="process.args">\.\.</field>
    <description>CVE-2026-110923: sftp client invoked with traversal-style path; possible malicious SFTP server path traversal.</description>
    <mitre>
      <id>T1565.001</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version data has been published for this CVE.

1. Immediate mitigations

   • Avoid running sftp copy operations against untrusted, unofficial, or unverified servers; restrict transfers to known-good hosts with verified host keys.
   • Perform copies into a dedicated, expendable directory (e.g., a fresh temp or sandbox folder) and review landed files before use; do not copy directly into configuration, autorun, or user-profile directories.
   • Where feasible, wrap or post-process transfers so that resulting paths are validated and confined; treat any locally placed file from a remote SFTP server as untrusted.
   • Apply least-privilege filesystem permissions for accounts that perform SFTP fetches to limit where misplaced writes can land.

2. Patch / upgrade steps

   • Monitor the OpenSSH project and your distribution vendors for an official fix and affected-version advisory, then upgrade the OpenSSH client package as soon as a patched release is available.
   • Because patch confidence is 0/4, there is currently no release to upgrade to for this specific CVE; track the upstream advisory channel until a fix lands.
   • Re-verify host keys and re-establish trusted transfer paths after any client upgrade.

3. Long-term hardening

   • Enforce strict host key verification and, where possible, certificate-based or pinned trust for SFTP endpoints to prevent malicious-server substitution.
   • Integrate a client-side path-confinement control (or waiting on the upstream fix) and add file-integrity monitoring on sensitive directories to detect out-of-directory writes.
   • Incorporate SFTP transfer review into change-management; treat server-supplied filenames as untrusted input by policy.

References

• NVD — CVE-2026-110923: https://nvd.nist.gov/vuln/detail/CVE-2026-110923
• OpenSSH project (upstream advisories and release notes): https://www.openssh.com/
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1565.001 — Data Manipulation: Stored Data Manipulation: https://attack.mitre.org/techniques/T1565/001/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-110923 is not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploitation status: No public PoC, exploit code, or Nuclei template is available; the CVE is not in CISA KEV; no EPSS score has been assigned by FIRST.org. No threat actor campaign or in-the-wild exploitation evidence has been reported in the available data.