Log in Start free

Vulnerability · Published Aug 19, 2026 · Assigned by GitHub_M

CVE-2026-48711SSHFS: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

High 7.0

In plain English

A high-severity argument injection in sshfs from libfuse. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.2%top 85.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as [-oProxyCommand=CMD]:/path and find_base_path() removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line argument. When a caller also supplies a path-valued sftp_server, ssh treats the normalized host as an option and the server path as its destination, causing an injected ProxyCommand to execute locally before any connection or authentication succeeds. The attack requires a caller or wrapper that passes an attacker-controlled mount source to SSHFS with the required sftp_server configuration and results in arbitrary command execution as the user running SSHFS. This issue is fixed in version 3.7.6.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20sshfs3.7.6-r0ALPINE-CVE-2026-48711
Alpine:v3.21sshfs3.7.6-r0ALPINE-CVE-2026-48711
Alpine:v3.22sshfs3.7.6-r0ALPINE-CVE-2026-48711
Alpine:v3.23sshfs3.7.6-r0ALPINE-CVE-2026-48711
Alpine:v3.24sshfs3.7.6-r0ALPINE-CVE-2026-48711
Debian:12sshfs-fuse3.7.3-1.2~deb12u1DEBIAN-CVE-2026-48711
Debian:13sshfs-fuse3.7.3-1.2~deb13u1DEBIAN-CVE-2026-48711
Debian:14sshfs-fuse3.7.3-1.2DEBIAN-CVE-2026-48711
Ubuntu:22.04:LTSsshfs-fuseno fix listedUBUNTU-CVE-2026-48711
Ubuntu:24.04:LTSsshfs-fuseno fix listedUBUNTU-CVE-2026-48711
Ubuntu:25.10sshfs-fuseno fix listedUBUNTU-CVE-2026-48711
Ubuntu:26.04:LTSsshfs-fuseno fix listedUBUNTU-CVE-2026-48711
Ubuntu:26.10sshfs-fuseno fix listedUBUNTU-CVE-2026-48711

Affected products (as reported)

VendorProductVersions
libfuse sshfs < 3.7.6

Weakness: CWE-88 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References