CVE-2026-110923: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Red Hat Red Hat Hardened Images

CVE-2026-110923 describes a directory traversal flaw in OpenSSH's sftp client. When copying files via sftp, a malicious server can supply an empty filename, a path with only slashes, or a ".." basename. The sftp client uses these values as the local destination path, which can result in writing files outside the user-selected directory. This vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

The vulnerability allows a malicious sftp server to cause the client to write files outside the intended directory, potentially overwriting or creating files in arbitrary locations on the client system. This can lead to integrity violations on the client side. Confidentiality and availability impacts are not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when connecting to untrusted sftp servers and avoid transferring files from untrusted sources.