{"vulnerability": "cve-2026-5999", "sightings": [{"uuid": "e9580816-fe69-4916-8bea-00490b1de2e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59992", "type": "published-proof-of-concept", "source": "https://github.com/tinacms/tinacms/security/advisories/GHSA-8mq9-5fw2-5rm4", "content": "", "creation_timestamp": "2026-08-19T22:35:05.147536Z"}, {"uuid": "dd474f4d-460b-4d5a-9cf8-f59d33c9c4de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-59995", "type": "seen", "source": "https://gist.github.com/alon710/44be7e1a209e5efdfe9c767d3a86a09b", "content": "# CVE-2026-59995: CVE-2026-59995: Relative Path Traversal in OpenSSH sftp Client\n\n> **CVSS Score:** 4.2\n> **Published:** 2026-07-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59995\n\n## Summary\nA relative path traversal vulnerability (CWE-23) in the client-side sftp utility of OpenSSH before version 10.4 allows malicious or compromised SFTP servers to write or overwrite files outside the intended destination directory when a user executes a direct one-shot download command.\n\n## TL;DR\nOpenSSH sftp clients prior to 10.4 are vulnerable to relative path traversal, allowing a compromised SFTP server to write arbitrary files on the client system during command-line downloads.\n\n## Technical Details\n\n- **CWE ID**: CWE-23\n- **Attack Vector**: Network\n- **CVSS Score**: 4.2 (Medium)\n- **EPSS Score**: 0.0025 (16.73%)\n- **Impact**: Low Integrity, Low Availability\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- OpenSSH sftp client prior to version 10.4\n- **OpenSSH sftp**: < 10.4 (Fixed in: `10.4`)\n\n## Mitigation\n\n- Upgrade client-side OpenSSH to version 10.4 or higher.\n- Avoid using direct, one-shot download syntax: sftp server:/path .\n- Establish restrictive client-side file access policies or use isolation/sandboxing techniques.\n\n**Remediation Steps:**\n1. Identify the local OpenSSH sftp version using 'sftp -V'.\n2. Apply system package updates using the local package manager (apt, dnf, yum) to update openssh-client or openssh-clients to 10.4 or above.\n3. In environments where updates are blocked, implement AppArmor or SELinux policies to restrict the write directories of the sftp binary.\n\n## References\n\n- [NVD CVE-2026-59995 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-59995)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-59995)\n- [OpenSSH 10.4 Official Release Notes](https://www.openssh.org/releasenotes.html#10.4p1)\n- [oss-security Mailing List Release Announcement](https://www.openwall.com/lists/oss-security/2026/07/06/5)\n- [OpenSSH UNIX Dev Mailing List Archive](https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2)\n- [Wiz Vulnerability Database Profile](https://www.wiz.io/vulnerability-database/cve/cve-2026-59995)\n- [OSV JSON Entry](https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59995.json)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59995) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-21T16:32:54.579911Z"}, {"uuid": "a60713c2-9996-4efa-b167-187788f4262b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59995", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq47zpcevu24", "content": "CVE-2026-59995 - OpenSSH SFTP Path Traversal Vulnerability\nCVE ID : CVE-2026-59995\n \n Published : July 8, 2026, 1:16 a.m. | 2\u00a0hours, 32\u00a0minutes ago\n \n Description : sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when \"sftp server:/path...", "creation_timestamp": "2026-07-08T03:56:51.913000Z"}, {"uuid": "2a5e4f3d-40f6-4c5c-bdd9-06f5f8c8e4b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59999", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq4aaga2ts27", "content": "CVE-2026-59999 - OpenSSH sshd Security Policy Bypass\nCVE ID : CVE-2026-59999\n \n Published : July 8, 2026, 1:16 a.m. | 2\u00a0hours, 32\u00a0minutes ago\n \n Description : In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did n...", "creation_timestamp": "2026-07-08T04:00:36.889539Z"}, {"uuid": "b7da5626-5ff7-47d0-b294-40bcaf2e77d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59996", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq4ai3r6lf2w", "content": "CVE-2026-59996 - OpenSSH SCP Directory Traversal Vulnerability\nCVE ID : CVE-2026-59996\n \n Published : July 8, 2026, 1:16 a.m. | 2\u00a0hours, 32\u00a0minutes ago\n \n Description : scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy o...", "creation_timestamp": "2026-07-08T04:04:54.401877Z"}, {"uuid": "681748a0-0503-449a-aa82-938bf2d5fbc3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59998", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq4bcx42hb2q", "content": "CVE-2026-59998 - OpenSSH GSSAPI Authentication Security Bypass\nCVE ID : CVE-2026-59998\n \n Published : July 8, 2026, 1:16 a.m. | 2\u00a0hours, 32\u00a0minutes ago\n \n Description : sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no...", "creation_timestamp": "2026-07-08T04:19:55.976573Z"}, {"uuid": "9db99855-7f20-4f62-afb8-ef8a4204a7b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59997", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq4blvjx2p24", "content": "CVE-2026-59997 - OpenSSH internal-sftp Argument Parsing Vulnerability\nCVE ID : CVE-2026-59997\n \n Published : July 8, 2026, 1:16 a.m. | 2\u00a0hours, 32\u00a0minutes ago\n \n Description : internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, whic...", "creation_timestamp": "2026-07-08T04:24:55.953948Z"}, {"uuid": "87eb63d0-598a-4824-a116-b3dae4232b2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59995", "type": "seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3mq677cepsk2y", "content": "OpenSSH\u306e\u8106\u5f31\u6027(Moderate: CVE-2026-59995, CVE-2026-59996, CVE-2026-59997, CVE-2026-59998, CVE-2026-59999)\u3068OpenSSH 10.4/10.4p1\u30ea\u30ea\u30fc\u30b9\n\n#sios_tech #security #vulnerability #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u8106\u5f31\u6027 #linux #openssh #ssh\n\nsecurity.sios.jp/vulnerabilit...", "creation_timestamp": "2026-07-08T22:47:27.116547Z"}, {"uuid": "326aba8b-69d2-4594-ae38-e866f5218d74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59996", "type": "seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3mq677cepsk2y", "content": "OpenSSH\u306e\u8106\u5f31\u6027(Moderate: CVE-2026-59995, CVE-2026-59996, CVE-2026-59997, CVE-2026-59998, CVE-2026-59999)\u3068OpenSSH 10.4/10.4p1\u30ea\u30ea\u30fc\u30b9\n\n#sios_tech #security #vulnerability #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u8106\u5f31\u6027 #linux #openssh #ssh\n\nsecurity.sios.jp/vulnerabilit...", "creation_timestamp": "2026-07-08T22:47:27.164751Z"}, {"uuid": "fda9db5b-afd2-4419-83c0-d9884fa9f282", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59997", "type": "seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3mq677cepsk2y", "content": "OpenSSH\u306e\u8106\u5f31\u6027(Moderate: CVE-2026-59995, CVE-2026-59996, CVE-2026-59997, CVE-2026-59998, CVE-2026-59999)\u3068OpenSSH 10.4/10.4p1\u30ea\u30ea\u30fc\u30b9\n\n#sios_tech #security #vulnerability #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u8106\u5f31\u6027 #linux #openssh #ssh\n\nsecurity.sios.jp/vulnerabilit...", "creation_timestamp": "2026-07-08T22:47:27.204093Z"}, {"uuid": "2a871de4-cb4b-41ba-8c0d-0dc9918ad133", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59998", "type": "seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3mq677cepsk2y", "content": "OpenSSH\u306e\u8106\u5f31\u6027(Moderate: CVE-2026-59995, CVE-2026-59996, CVE-2026-59997, CVE-2026-59998, CVE-2026-59999)\u3068OpenSSH 10.4/10.4p1\u30ea\u30ea\u30fc\u30b9\n\n#sios_tech #security #vulnerability #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u8106\u5f31\u6027 #linux #openssh #ssh\n\nsecurity.sios.jp/vulnerabilit...", "creation_timestamp": "2026-07-08T22:47:27.240278Z"}, {"uuid": "27ee7c9f-df72-415a-b816-fc0c0d52eac5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59999", "type": "seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3mq677cepsk2y", "content": "OpenSSH\u306e\u8106\u5f31\u6027(Moderate: CVE-2026-59995, CVE-2026-59996, CVE-2026-59997, CVE-2026-59998, CVE-2026-59999)\u3068OpenSSH 10.4/10.4p1\u30ea\u30ea\u30fc\u30b9\n\n#sios_tech #security #vulnerability #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u8106\u5f31\u6027 #linux #openssh #ssh\n\nsecurity.sios.jp/vulnerabilit...", "creation_timestamp": "2026-07-08T22:47:27.271580Z"}, {"uuid": "5835e9af-3bb2-4ac1-8b14-a044e95c706b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59999", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq7r45hjm42d", "content": "CVE-2026-59999: OpenSSH's Flawed Configuration Puts Systems at Risk #CVE2026 #OpenSSH #CyberSecurity", "creation_timestamp": "2026-07-09T13:40:27.067050Z"}, {"uuid": "46faaf81-c1f2-4f8b-8985-9a9b8f861a3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59999", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq7r477tgr2s", "content": "CVE-2026-59999: OpenSSH's Misconfiguration Lets Attackers Bypass Forwarding Controls #CVE2026 #OpenSSH #Cybersecurity", "creation_timestamp": "2026-07-09T13:40:28.891821Z"}, {"uuid": "0c82cd31-6313-4d91-a630-a0d28824935a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59999", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq7r4atl7a22", "content": "CVE-2026-59999: OpenSSH\u2019s Configuration Failure Undermines Secure Tunneling #CVE2026 #OpenSSH #Security", "creation_timestamp": "2026-07-09T13:40:30.501618Z"}, {"uuid": "801e7111-c84c-4119-bd7a-bc1a33a019fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59999", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq7r4crqv426", "content": "CVE-2026-59999 Exposes Flaw in OpenSSH's Configuration Priority \u2014 Audit Now #OpenSSH #CVE2026 #CyberSecurity", "creation_timestamp": "2026-07-09T13:40:32.417624Z"}, {"uuid": "2ed4b1a8-2859-418f-bf86-c42bd750fe6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59999", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq7ra3gey227", "content": "CVE-2026-59999: OpenSSH's Mishandled Settings Leave Users Exposed #OpenSSH #CyberSecurity #CVE2026", "creation_timestamp": "2026-07-09T13:42:39.134859Z"}, {"uuid": "743e4d19-852c-4a18-a919-5a89f87ddb6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59999", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq7ra5rulu2f", "content": "CVE-2026-59999: OpenSSH's Configuration Confusion or Exploit Opportunity? #CVE2026 #OpenSSH #CyberSecurity", "creation_timestamp": "2026-07-09T13:42:41.385134Z"}, {"uuid": "17743ea9-80fc-4a35-98d2-341936e24372", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59995", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mqbbbatvik2g", "content": "MEDIUM severity CVE just published in OpenSSH:\n\nCVE-2026-59995. sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when \"sftp server:/path .\" is used with an attacker-controlled server.\n\nnvd.nist.gov/vuln/detail/CVE-2026-59995", "creation_timestamp": "2026-07-10T04:02:17.297972Z"}, {"uuid": "9d14df4e-9b6a-48d9-b7ca-c53cb13b98e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59996", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mqboolzoii26", "content": "New MEDIUM CVE for OpenSSH: CVE-2026-59996\n\nscp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.\n\nMore: nvd.nist.gov/vuln/detail/CVE-2026-59996", "creation_timestamp": "2026-07-10T08:02:23.824571Z"}, {"uuid": "d573e778-8dc1-44fc-a7ba-6425d56b6673", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59997", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mqc45uthbv22", "content": "OpenSSH: CVE-2026-59997 [MEDIUM]\n\ninternal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-59997", "creation_timestamp": "2026-07-10T12:03:35.215977Z"}, {"uuid": "33cf821f-9a20-4b6a-aaee-f43cbf93a8d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59998", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mqdebnhp4u2c", "content": "MEDIUM severity CVE just published in OpenSSH:\n\nCVE-2026-59998. sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.\n\nnvd.nist.gov/vuln/detail/CVE-2026-59998", "creation_timestamp": "2026-07-11T00:01:31.376033Z"}, {"uuid": "027425cc-6798-497a-89e0-4639a802e957", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59999", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mqdrtxbpdl2r", "content": "New MEDIUM CVE for OpenSSH: CVE-2026-59999\n\nIn sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.\n\nMore: nvd.nist.gov/vuln/detail/CVE-2026-59999", "creation_timestamp": "2026-07-11T04:04:24.653803Z"}, {"uuid": "35a44f15-2993-4b1a-a21d-81dc3ee7ae21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59990", "type": "seen", "source": "https://bsky.app/profile/eed3si9n.com/post/3mqsqe4xchk2e", "content": "\ud83e\uddd1\u200d\ud83d\ude92 released sbt 1.12.14 and 2.0.3, featuring\n- backport of CVE-2026-26032 fix for Ivy (while sbt might not be affected)\n- update to Jawn 1.7.0 for CVE-2026-59990 and CVE-2026-61814 fixes\need3si9n.com/sbt-1.12.14-... #Scala", "creation_timestamp": "2026-07-17T02:47:35.819258Z"}]}