CVE-2026-110923: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Red Hat Red Hat Hardened Images

The vulnerability exists in OpenSSH's sftp client implementation on Red Hat Enterprise Linux 10. When copying files via sftp, a malicious server can provide crafted pathnames such as empty names, paths consisting only of slashes, or '..' basenames. These inputs cause the sftp client to write files outside the user-selected local directory, effectively bypassing directory restrictions and enabling unauthorized file writes.

The flaw allows an attacker controlling an sftp server to write files outside the intended local directory on the client machine. This can lead to unauthorized modification of local files, potentially impacting system integrity. The CVSS score of 6.5 (medium severity) reflects the network attack vector with low complexity and no privileges required, but user interaction is needed.

The vendor advisory from Red Hat should be consulted for current remediation guidance. No explicit patch information is provided in the input data. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-110923 for updates. Until a fix is applied, users should exercise caution when connecting to untrusted sftp servers.