This vulnerability in libssh involves improper sanitation of paths received from SCP servers, allowing a malicious SCP server to send unexpected pathnames that cause the client to overwrite files outside the working directory. This path traversal flaw could be exploited to create or overwrite local files, potentially leading to execution of malicious code or configuration changes under certain conditions. The vulnerability is tracked as CVE-2026-0964 and affects Red Hat Enterprise Linux 10. Red Hat has issued security advisories and updated libssh packages to fix this issue by properly sanitizing SCP paths.

The vulnerability allows a remote attacker controlling an SCP server to cause the client to overwrite arbitrary files on the local system outside the intended directory. This can lead to local file corruption or the creation of malicious executables or configuration files, which could be executed by the user, resulting in limited confidentiality, integrity, and availability impacts. The CVSS v3.0 base score is 5.0 (medium severity) with network attack vector, high attack complexity, no privileges required, user interaction required, and low impact on confidentiality, integrity, and availability.

Red Hat has released official security updates for libssh in Red Hat Enterprise Linux 10 that address CVE-2026-0964 by fixing the improper path sanitation in SCP. Users and administrators should apply the updated libssh packages as provided in Red Hat Advisory RHSA-2026:18160. Detailed update instructions are available at https://access.redhat.com/articles/11258. Applying these updates mitigates the vulnerability. No additional mitigations are specified or required beyond applying the official patches.