CVE-2026-47187

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47187
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47187.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47187
Aliases
  • GHSA-pjv6-2c3f-r357
Downstream
Related
Published
2026-08-19T14:41:57Z
Modified
2026-09-11T09:01:31Z
Severity
  • 9.3 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write
Details

SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local filesystem. The documented transform_symlinks mitigation does not contain relative targets because transform_symlink() returns early at sshfs.c:2181, while sshfs_readlink() at sshfs.c:2234 to sshfs.c:2236 otherwise copies the server-supplied link target to the kernel. A victim or victim-side tool that follows such a link through ordinary operations such as cp, rsync, backup tooling, or an editor can disclose readable local files back to the server or write server-controlled content to writable local files, potentially including startup or scheduled-task files. This issue is fixed in version 3.7.6.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-59"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47187.json"
}
References

Affected packages

Git / github.com/libfuse/sshfs

Affected ranges

Type
GIT
Repo
https://github.com/libfuse/sshfs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bcd132f17ccf1b8592a229df797c9b08883fec26
Fixed
7a2d988775446ebe7af9b01c99b3b8e86bddb05a
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.7.6"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

sshfs-2.*
sshfs-2.7
sshfs-2.9
sshfs-3.*
sshfs-3.0.0
sshfs-3.1.0
sshfs-3.2.0
sshfs-3.3.0
sshfs-3.3.1
sshfs-3.3.2
sshfs-3.4.0
sshfs-3.5.0
sshfs-3.5.1
sshfs-3.5.2
sshfs-3.6.0
sshfs-3.7.0
sshfs-3.7.1
sshfs-3.7.2
sshfs-3.7.3
sshfs-3.7.5
Other
sshfs_0_1
sshfs_1_0
sshfs_1_1
sshfs_1_2
sshfs_1_3
sshfs_1_4
sshfs_1_5
sshfs_1_6
sshfs_1_7
sshfs_1_8
sshfs_1_9
sshfs_2_0
sshfs_2_1
sshfs_2_2
sshfs_2_3
sshfs_2_4
sshfs_2_5
sshfs_2_6
start
sshfs_2.*
sshfs_2.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47187.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "317272630049350197677837943668192064217",
            "length": 4054
        },
        "id": "CVE-2026-47187-6514bbdf",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/libfuse/sshfs/commit/bcd132f17ccf1b8592a229df797c9b08883fec26",
        "target": {
            "file": "sshfs.c",
            "function": "usage"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "111591966655425813342267849426680359541",
                "281626211524996841165453792662131558773",
                "198444047919678707760498214621973683477",
                "94677040634081721981625619569946528228",
                "289425627002648549744764742223037581392",
                "189684179441161038766837531584182067243",
                "291376636178870029392115587374955435064",
                "109414893350300710763629358979614094685",
                "234348579678007972904543751815398012366",
                "46860849004072779554778507252503729616",
                "273782617283073026333798790862904175684",
                "315291643282660396384095789851999696969",
                "322555254319289611053935149618997556422",
                "324636544583373582569775866492020319728",
                "74060390354445126689740304929201978265",
                "333968169754011107202433799429518016934",
                "128074147508762739729106462406276143783",
                "178157335242660685047547397548256883979",
                "149128679661580619272257442142252259280",
                "300670053028013836988788350859727603423",
                "66207154123322850034077801098836123516",
                "222316894158150101020429596923439499377",
                "75568975949275579191111011375328001267",
                "158112596417426516566592707394078542932",
                "180031582017526856608319532592492036474"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-47187-7771ff69",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/libfuse/sshfs/commit/bcd132f17ccf1b8592a229df797c9b08883fec26",
        "target": {
            "file": "sshfs.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "244817382475524797287987392133722910440",
            "length": 707
        },
        "id": "CVE-2026-47187-be1b8dc2",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/libfuse/sshfs/commit/bcd132f17ccf1b8592a229df797c9b08883fec26",
        "target": {
            "file": "sshfs.c",
            "function": "sshfs_readlink"
        }
    }
]
vanir_signatures_modified 
"2026-09-11T09:01:31Z"