CVE-2026-0964

MediumCVSS 6.3/10Last modified Sep 1, 2026

Description

A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences.

This is the same issue as in OpenSSH, tracked as CVE-2019-6111.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Mar 26, 2026
Last modified: Sep 1, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-09653.3A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by p CVE-2026-09668.2A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This c CVE-2026-09675.5A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostname CVE-2026-09683.1A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' CVE-2026-09698.8The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of CVE-2026-09714.3An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected t CVE-2026-09725.4HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and descriptio CVE-2026-09748.8The Orderable – WordPress Restaurant Online Ordering System and Food Ordering Plugin plugin for WordPress is vulnerable to unauthorized plug CVE-2026-09759.8Delta Electronics DIAView has Command Injection vulnerability.CVE-2026-09763.7A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters i CVE-2026-09777.1IBM CICS Transaction Gateway for Multiplatforms 9.3 and 10.1 could allow a user to transfer or view files due to improper access controls.CVE-2026-09808.8A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller (BMC) component of Red Hat Satellite. An authenticated attac