CVE-2026-59996 is a relative path traversal vulnerability in the scp component of OpenSSH before version 10.4. When copying files between two remote hosts, scp may incorrectly place files in the parent directory of the intended destination directory. This behavior could lead to unintended file placement, potentially affecting system integrity or file organization. The vulnerability does not impact confidentiality but has limited impact on integrity and availability.

The vulnerability allows an attacker or user to cause files to be written outside the intended directory, specifically in the parent directory. This could lead to limited integrity issues by overwriting or placing files in unintended locations. There is no impact on confidentiality. The availability impact is low, as it may cause unexpected file placement but not denial of service.

No official patch or remediation level has been confirmed or provided by the vendor at this time. Users should upgrade to OpenSSH version 10.4 or later once available, as the vulnerability affects versions prior to 10.4. Until a fix is confirmed, exercise caution when using scp for copying files between two remote destinations. Patch status is not yet confirmed — check the OpenBSD or OpenSSH vendor advisories for current remediation guidance.