CVE-2026-59996 describes a CWE-23 relative path traversal vulnerability in the scp component of OpenSSH before version 10.4. When copying files between two remote destinations, scp may incorrectly place a file in the parent directory of the intended directory. This behavior could lead to unintended file placement, potentially impacting system integrity or availability. The vulnerability does not involve confidentiality loss but has limited impact on integrity and availability. No official remediation level or patch information is provided in the available data.

The vulnerability allows files to be placed outside the intended directory during remote-to-remote copy operations using scp, which may lead to unintended file overwrites or placement in parent directories. This can cause limited integrity and availability impacts but does not affect confidentiality. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the OpenBSD or OpenSSH vendor advisory for current remediation guidance. Since the vulnerability affects versions prior to 10.4, upgrading to OpenSSH 10.4 or later is recommended once a fix is available. Until then, avoid using scp for remote-to-remote copies or implement alternative secure file transfer methods.