CVE-2026-48711

SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as [-oProxyCommand=CMD]:/path and find_base_path() removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line argument. When a caller also supplies a path-valued sftp_server, ssh treats the normalized host as an option and the server path as its destination, causing an injected ProxyCommand to execute locally before any connection or authentication succeeds. The attack requires a caller or wrapper that passes an attacker-controlled mount source to SSHFS with the required sftp_server configuration and results in arbitrary command execution as the user running SSHFS. This issue is fixed in version 3.7.6.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-88"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48711.json"
}

References

Affected packages

Git / github.com/libfuse/sshfs

Affected ranges

Type

GIT

Repo

https://github.com/libfuse/sshfs

Events

Introduced

Fixed

29bb565ea6405e2dd5a0ea65fe64da117e76055e

Fixed

7a2d988775446ebe7af9b01c99b3b8e86bddb05a

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.7.6"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

sshfs-2.*

sshfs-2.7

sshfs-2.9

sshfs-3.*

sshfs-3.0.0

sshfs-3.1.0

sshfs-3.2.0

sshfs-3.3.0

sshfs-3.3.1

sshfs-3.3.2

sshfs-3.4.0

sshfs-3.5.0

sshfs-3.5.1

sshfs-3.5.2

sshfs-3.6.0

sshfs-3.7.0

sshfs-3.7.1

sshfs-3.7.2

sshfs-3.7.3

sshfs-3.7.5

Other

sshfs_0_1

sshfs_1_0

sshfs_1_1

sshfs_1_2

sshfs_1_3

sshfs_1_4

sshfs_1_5

sshfs_1_6

sshfs_1_7

sshfs_1_8

sshfs_1_9

sshfs_2_0

sshfs_2_1

sshfs_2_2

sshfs_2_3

sshfs_2_4

sshfs_2_5

sshfs_2_6

start

sshfs_2.*

sshfs_2.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48711.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "309584893999553188116404500351351057828",
                "181786449653195377737205133354174091546",
                "282974872392293010627283358441059304549",
                "216175821741696232051978411940720496421",
                "89635256995540938472379471932870445660",
                "262100792127562134334218958817507902283",
                "318035254076559168710622116507756489038",
                "175663789194528381675043739723506084475",
                "169536329875381571268583391264438544843",
                "306268991904266160053245502135956250905"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-48711-b14d8509",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/libfuse/sshfs/commit/29bb565ea6405e2dd5a0ea65fe64da117e76055e",
        "target": {
            "file": "sshfs.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "243900361695119522486824170334820975130",
            "length": 375
        },
        "id": "CVE-2026-48711-df4b7ccb",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/libfuse/sshfs/commit/29bb565ea6405e2dd5a0ea65fe64da117e76055e",
        "target": {
            "file": "sshfs.c",
            "function": "find_base_path"
        }
    }
]

vanir_signatures_modified

"2026-09-11T09:02:40Z"