CVE-2026-106552: CWE-23 Relative Path Traversal in OpenBSD OpenSSH

This vulnerability (CWE-23) exists in the sftp subsystem of OpenSSH prior to version 10.6. During recursive copy operations, a malicious server can exploit relative path traversal to write files outside the intended directory structure. This could lead to unintended file writes, potentially impacting system integrity or availability. The vulnerability is network exploitable without privileges but requires user interaction.

The impact is limited to integrity and availability with no confidentiality loss. An attacker controlling the server can cause files to be written to arbitrary locations on the client during recursive copy operations, potentially overwriting or corrupting files. There is no indication of active exploitation in the wild.

Upgrade OpenSSH to version 10.6 or later where this vulnerability is fixed. Since this is a client-side vulnerability triggered by server interaction, avoid connecting to untrusted or malicious sftp servers until patched. Patch status is not explicitly confirmed in the input but the affected versions are prior to 10.6, implying 10.6 contains the fix.