CVE-2026-59995 is a CWE-23 relative path traversal vulnerability in OpenSSH's sftp client before version 10.4. When a user runs the command "sftp server:/path ." with a malicious or attacker-controlled server, the client does not properly restrict where downloaded files are saved locally. This improper constraint could allow files to be written outside the intended directory, potentially overwriting or corrupting local files. The vulnerability has a CVSS 3.1 base score of 4.2, indicating medium severity, with network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

The vulnerability may allow an attacker controlling the sftp server to cause the client to write files to unintended locations on the local system, potentially leading to limited integrity and availability issues such as overwriting or corrupting local files. There is no confidentiality impact reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the OpenBSD vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when using sftp with untrusted servers, especially with commands that specify remote paths and local destination directories. Avoid running sftp commands that download files from untrusted servers to local directories without verifying the server's trustworthiness.