CVE-2019-6111
MediumCVSS 5.9Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
An issue was discovered in OpenSSH 7.9. Because the scp implementation derives from 1983 rcp, the server chooses which files and directories are sent to the client, while the scp client only performs cursory validation of the returned object name (only directory traversal attacks are prevented). A malicious scp server or Man-in-The-Middle attacker can overwrite arbitrary files in the scp client target directory, and with recursive operation (-r) can manipulate subdirectories, for example to overwrite .ssh/authorized_keys.
Risk Assessment
An attacker can overwrite arbitrary files in the scp client target directory, including SSH authorized keys, potentially leading to account takeover or further escalation. The risk occurs when connecting to untrusted scp servers.
Recommendation
Upgrade OpenSSH to a version containing the fix or use a newer scp client with filename validation. Avoid recursive copies from untrusted servers and consider using SFTP instead of scp.
Other vulnerabilities in OpenSSH
See all- CVE-2026-97811High
Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
- CVE-2026-83923High
Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
- CVE-2016-6515High
The auth_password function in sshd in OpenSSH before version 7.3 does not limit password lengths for authentication, allowing remote attackers to cause a denial of service via long strings.
- CVE-2015-8325High
The do_setup_env function in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program.
- CVE-2015-5600High
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection. This allows remote attackers to conduct brute-force attacks or cause denial of service via a long and duplicative list in the ssh -oKbdInteractiveDevices option.
- CVE-2014-1692High
The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures. This may allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via vectors that trigger an error condition.
- CVE-2025-32728Medium
In sshd in OpenSSH before version 10.0, the DisableForwarding directive does not adhere to documentation, failing to disable X11 and agent forwarding.
- CVE-2026-39832Critical
When adding a key to a remote agent, constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host.
- CVE-2026-39831Critical
Vulnerability in the Verify() method for FIDO/U2F security keys ([email protected], [email protected]) – the User Presence flag was not checked. Signatures generated without physical touch were accepted, allowing unauthorized use of the key.
- CVE-2025-26466Medium
A flaw in the OpenSSH package causes each received ping packet to allocate a pong packet in memory, stored in a queue until key exchange completes. A malicious client can send such packets continuously, leading to uncontrolled memory consumption on the server.
Original NVD description (English source)
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS