AZL-92042

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-92042.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-92042

Upstream

CVE-2026-59995

Published

2026-07-08T01:16:28Z

Modified

2026-08-29T05:27:27Z

Summary

CVE-2026-59995 affecting package openssh for versions less than 9.8p1-9

Details

sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-59995

Affected packages

Azure Linux:3 / openssh

Package

Name: openssh
Purl: pkg:rpm/azure-linux/openssh

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9.8p1-9

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-92042.json"