From 36480181fa22f98e180b4f9e10203480c0346c78 Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Sun, 28 Jun 2026 23:47:16 +0000 Subject: [PATCH] upstream: resist that return ".." via remote glob during remote/remote copies, similar to fixes for bz3871 for remote/local copies. From Swival scanner OpenBSD-Commit-ID: c0c20a1b746db55c08e53658bf21ea9405b300a5 CVE: CVE-2026-59996 Upstream: https://github.com/openssh/openssh-portable/commit/36480181fa22f98e180b4f9e10203480c0346c78 Signed-off-by: Thomas Perale --- scp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/scp.c b/scp.c index 621db83c02d1..28ac7a29d2a3 100644 --- a/scp.c +++ b/scp.c @@ -2045,6 +2045,10 @@ throughlocal_sftp(struct sftp_conn *from, struct sftp_conn *to, goto out; } + /* Special handling for source of '..' */ + if (strcmp(filename, "..") == 0) + filename = "."; /* Download to dest, not dest/.. */ + if (targetisdir) abs_dst = sftp_path_append(target, filename); else