CVE-2026-48711: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in libfuse sshfs
CVE-2026-48711 is a high-severity vulnerability in sshfs, a network filesystem client for SSH servers. Versions prior to 3.7.6 accept a bracketed mount source that can be manipulated to inject arbitrary commands via the ProxyCommand option. This occurs because the host value, after bracket removal, begins with a dash and is passed directly to ssh as a command-line argument, allowing command execution before authentication. The vulnerability requires a caller or wrapper to supply a crafted mount source and sftp_server path. It is fixed in version 3.7.6.
AI Analysis
Technical Summary
SSHFS versions from 1.4 up to but not including 3.7.6 improperly neutralize argument delimiters in the mount source input. Specifically, the find_base_path() function removes brackets from a mount source like [-oProxyCommand=CMD]:/path, resulting in a host value starting with a dash. When combined with a path-valued sftp_server parameter, ssh interprets this host value as an option and the sftp_server path as its destination. This leads to execution of the injected ProxyCommand locally before any SSH connection or authentication occurs. The vulnerability allows arbitrary command execution with the privileges of the user running sshfs. The issue is resolved in sshfs version 3.7.6.
Potential Impact
An attacker able to control the mount source argument and sftp_server configuration can execute arbitrary commands locally as the user running sshfs. This can lead to full compromise of the user's environment, including confidentiality, integrity, and availability impacts. The vulnerability requires local or limited remote control over mount parameters but does not require prior authentication to the SSH server.
Mitigation Recommendations
This vulnerability is fixed in sshfs version 3.7.6. Users should upgrade to version 3.7.6 or later to remediate this issue. No official patch or workaround is indicated beyond upgrading. Until upgraded, avoid passing untrusted input to sshfs mount source parameters, especially when using the sftp_server option.
CVE-2026-48711: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in libfuse sshfs
Description
CVE-2026-48711 is a high-severity vulnerability in sshfs, a network filesystem client for SSH servers. Versions prior to 3.7.6 accept a bracketed mount source that can be manipulated to inject arbitrary commands via the ProxyCommand option. This occurs because the host value, after bracket removal, begins with a dash and is passed directly to ssh as a command-line argument, allowing command execution before authentication. The vulnerability requires a caller or wrapper to supply a crafted mount source and sftp_server path. It is fixed in version 3.7.6.
CVSS v3.1
Score 7.0high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
SSHFS versions from 1.4 up to but not including 3.7.6 improperly neutralize argument delimiters in the mount source input. Specifically, the find_base_path() function removes brackets from a mount source like [-oProxyCommand=CMD]:/path, resulting in a host value starting with a dash. When combined with a path-valued sftp_server parameter, ssh interprets this host value as an option and the sftp_server path as its destination. This leads to execution of the injected ProxyCommand locally before any SSH connection or authentication occurs. The vulnerability allows arbitrary command execution with the privileges of the user running sshfs. The issue is resolved in sshfs version 3.7.6.
Potential Impact
An attacker able to control the mount source argument and sftp_server configuration can execute arbitrary commands locally as the user running sshfs. This can lead to full compromise of the user's environment, including confidentiality, integrity, and availability impacts. The vulnerability requires local or limited remote control over mount parameters but does not require prior authentication to the SSH server.
Mitigation Recommendations
This vulnerability is fixed in sshfs version 3.7.6. Users should upgrade to version 3.7.6 or later to remediate this issue. No official patch or workaround is indicated beyond upgrading. Until upgraded, avoid passing untrusted input to sshfs mount source parameters, especially when using the sftp_server option.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-22T18:47:27.755Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a85c70aacd9273b493b3060
Added to database: 08/19/2026, 15:08:58 UTC
Last enriched: 08/19/2026, 15:23:17 UTC
Last updated: 08/19/2026, 17:11:01 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.