Read the docs
TI-2026-35992 Aliases CVE-2026-48711

SSHFS: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Priority HIGH 66CWE-88Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-88.

Summary

SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as [-oProxyCommand=CMD]:/path and find_base_path() removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line argument. When a caller also supplies a path-valued sftp_server, ssh treats the normalized host as an option and the server path as its destination, causing an injected ProxyCommand to execute locally before any connection or authentication succeeds. The attack requires a caller or wrapper that passes an attacker-controlled mount source to SSHFS with the required sftp_server configuration and results in arbitrary command execution as the user running SSHFS. This issue is fixed in version 3.7.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00236 14th percentileScored 2026-11-07
Fix Partial sshfs (libfuse): 3.7.6Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
libfusesshfsbefore 3.7.63.7.6Patch availableCNA
  • sshfs Vendorlibfuse Affected before 3.7.6 Fixed in 3.7.6 Patch available CNA

Remediation

  • Fix · CNA sshfs (libfuse) Fixed in 3.7.6

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix yet

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48711
  2. 2026-10-05 Affected versions changed · Red Hat
  3. 2026-10-05 CVSS score added · Red Hat
  4. 2026-11-04 Affected versions changed · Red Hat
  5. 2026-11-04 CVSS score added · Red Hat

References

Other 4

  • TI-2026-34775 SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write CVSS 3.1CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences