CVE-2026-0964

{"id": "CVE-2026-0964", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.6}]}, "published": "2026-03-26T21:17:00.393", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-0964", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436979", "source": "secalert@redhat.com"}, {"url": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A malicious SCP server can send unexpected paths that could make the\nclient application override local files outside of working directory.\nThis could be misused to create malicious executable or configuration\nfiles and make the user execute them under specific consequences.\n\nThis is the same issue as in OpenSSH, tracked as CVE-2019-6111."}, {"lang": "es", "value": "Un servidor SCP malicioso puede enviar rutas inesperadas que podr\u00edan hacer que la aplicaci\u00f3n cliente sobrescriba archivos locales fuera del directorio de trabajo. Esto podr\u00eda ser mal utilizado para crear archivos ejecutables o de configuraci\u00f3n maliciosos y hacer que el usuario los ejecute bajo consecuencias espec\u00edficas.\n\nEste es el mismo problema que en OpenSSH, rastreado como CVE-2019-6111."}], "lastModified": "2026-03-30T13:26:50.827", "sourceIdentifier": "secalert@redhat.com"}