ZeroDay Findings
Sign inSign up

Findings

CVE-2026-0964

A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory.

Published Mar 26, 2026 · updated Sep 1, 2026 · libssh libssh

A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue as in OpenSSH, tracked as CVE-2019-6111.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 26, 2026 · NIST NVD

    Detected

    A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue as in OpenSSH, tracked as CVE-2019-6111.

  2. Sep 1, 2026 · NIST NVD

    Updated

    A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue as in OpenSSH, tracked as CVE-2019-6111.

Affected

  • cpe libssh/libsshversion unspecified
  • cpe redhat/enterprise linux10.0
  • cpe redhat/enterprise linux8.0
  • cpe redhat/enterprise linux9.0
  • cpe redhat/hardened imagesversion unspecified
  • cpe redhat/openshift container platform4.0

Sources

  • CVE.orgVulnerability recordCVE-2026-0964

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-0964

    A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This

    nvd.nist.gov

References