This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-59995 →
UBUNTU-CVE-2026-59995
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlle...
Original description
The description as published by the source.
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:Pro:14.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.6p1-2ubuntu2.13+esm4"}]}]
Ubuntu:Pro:16.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.10+esm10"}]}]
Ubuntu:Pro:FIPS-updates:16.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:FIPS:16.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:18.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.6p1-4ubuntu0.7+esm6"}]}]
Ubuntu:18.04:LTS
openssh-ssh1
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:FIPS-updates:18.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:FIPS:18.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:20.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2p1-4ubuntu0.13+esm3"}]}]
Ubuntu:20.04:LTS
openssh-ssh1
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:FIPS-updates:20.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:FIPS:20.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.9p1-3ubuntu0.16"}]}]
Ubuntu:22.04:LTS
openssh-ssh1
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:FIPS-preview:22.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:FIPS-updates:22.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.9p1-3ubuntu0.16+Fips3"}]}]
Ubuntu:24.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.6p1-3ubuntu13.18"}]}]
Ubuntu:24.04:LTS
openssh-ssh1
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:FIPS-updates:24.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.6p1-3ubuntu13.18+Fips1"}]}]
Ubuntu:25.10
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:25.10
openssh-ssh1
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
openssh-ssh1
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.2p1-2ubuntu3.4"}]}]
Ubuntu:26.04:LTS
openssh-ssh1
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
References
- advisory ubuntu.com
- advisory ubuntu.com
- report ubuntu.com
- report cve.org
- report openssh.org