A malicious SCP server can deliver filenames that are not properly sanitized by libssh, allowing the client to overwrite arbitrary files outside the intended working directory. This vulnerability could be used to replace system binaries, place malicious executables, or alter configuration files, potentially leading to unauthorized code execution or privilege escalation.

The issue affects Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. Any system running a vulnerable version of libssh used by SSH/SCP clients on these platforms is potentially impacted.

The CVSS score is 5.0, indicating moderate severity, and the EPSS score is below 1 %, suggesting a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a malicious SCP server that sends a crafted path. The client blindly accepts the path and writes to the local filesystem, providing a clear attack vector for overwrite of critical files.