Search: CVE-2026-48711

CVE-2026-48711 is a command injection vulnerability in sshfs, a network filesystem client for SSH servers. Versions from 1.4 up to but not including 3.7.6 are affected. The flaw arises when sshfs accepts a bracketed mount source with a ProxyCommand option, improperly handling the host argument and allowing an attacker-controlled ProxyCommand to execute locally before SSH connection or authentication. This can lead to arbitrary command execution with the privileges of the user running sshfs. The issue is fixed in version 3.7.6.