SSHFS is a network filesystem client that connects to SSH servers. Before version 3.7.6, an attacker controlling a rogue SFTP server can return symlink targets that are absolute paths or relative paths containing parent‑directory components. These targets are passed unfiltered from SSHFS through the FUSE layer to the client kernel, which resolves them. The documented transform_symlinks mitigation fails because transform_symlink() returns early at sshfs.c:2181, allowing relative targets to slip through, and sshfs_readlink() from sshfs.c:2234 to sshfs.c:2236 copies the server‑supplied link target directly to the kernel. As a result, any local file that the client user can read or write can be accessed via a malicious symlink. Tools such as cp, rsync, backup utilities, or editors that follow such links can disclose local files to the server or allow the attacker to write to writable files, potentially including startup or scheduled‑task scripts. The issue was fixed in SSHFS 3.7.6.

The vulnerability affects the libfuse SSHFS client up to and including version 3.7.5. Any system running a pre‑3.7.6 build of SSHFS and connecting to an SFTP server may be impacted.

The CVSS score is 9.3, indicating a critical severity. The EPSS score is less than 1%, implying a low likelihood of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote: a rogue or compromised SFTP server can supply the malicious symlink data over an established SSH connection, requiring only that the client mount the filesystem. Because the flaw permits local file read and write for any file accessible to the client user, it allows potential confidentiality and integrity violations and could lead to full system compromise if the attacker can modify startup or scheduled‑task files.