CVE-2026-59996

MediumCVSS 5.4/10Last modified Oct 25, 2026

Description

scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-23

Affected software

VendorProductVersions
OpenBSDOpenSSH< 10.4

References

Timeline

Published
Jul 8, 2026
Last modified
Oct 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-599975.4internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-lCVE-2026-599986.5sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in WindoCVE-2026-599997.5In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.CVE-2026-60004.3A vulnerability was found in code-projects Online Library Management System 1.0. Affected is an unknown function of the file /sql/library.sqCVE-2026-600007.5sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attemptCVE-2026-600016.5sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.CVE-2026-600029.4ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only CVE-2026-600049.8Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.CVE-2026-600058.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex capturCVE-2026-600077.4In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding aCVE-2026-600083.5Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitizationCVE-2026-600098.8In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled
CVE-2026-59996: Medium severity, CVSS 5.4 | Vulnix