CVE-2026-47187: CWE-59: Improper Link Resolution Before File Access ('Link Following') in libfuse sshfs

SSHFS versions before 3.7.6 improperly handle symbolic link targets returned by a rogue SFTP server. Specifically, absolute symlink targets or relative targets containing parent-directory components are passed through FUSE for resolution by the client kernel against the local filesystem. The intended mitigation transform_symlinks does not handle relative targets correctly, allowing sshfs_readlink() to copy the server-supplied link target directly to the kernel. This flaw enables an attacker controlling the SFTP server to cause the client to disclose local files or overwrite writable local files, potentially including critical system files. The vulnerability is addressed in sshfs version 3.7.6.

An attacker controlling a malicious SFTP server can exploit this vulnerability to read local files on the client machine or write arbitrary content to writable local files. This can lead to disclosure of sensitive information or modification of critical files such as startup or scheduled-task files, potentially compromising the client system's integrity and confidentiality. The CVSS score of 9.3 reflects the high impact on confidentiality and integrity with no impact on availability.

This vulnerability is fixed in sshfs version 3.7.6. Users should upgrade to version 3.7.6 or later to remediate this issue. No additional mitigation is required if the upgrade is applied.