CVE-2026-0964

Katalog CVE

CVSS 6.3 · Medium EPSS 0,41%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada libssh, redhat hardened images +2 lainnya. Skor CVSS 3.1 6.3 (Medium) menurut NVD.

Deskripsi (NVD)

A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue as in OpenSSH, tracked as CVE-2019-6111.

Rincian

Terbit di NVD

26 Maret 2026

Terakhir diubah

1 September 2026

Status NVD

Modified

CVSS 3.1

6.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-0964 mitigasi · advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2436979 issue tracking · advisory vendor
• https://access.redhat.com/errata/RHSA-2026:18160
• https://access.redhat.com/errata/RHSA-2026:18683
• https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/ release notes