Is CVE-2026-110923 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110923?

CVE-2026-110923 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-110923

Description

A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected.