SSHFS contains an argument injection flaw that allows an attacker to execute arbitrary commands on the host system. The vulnerability arises when a mount source is supplied in a bracketed form such as [-oProxyCommand=CMD]:/path; the program removes the brackets and passes the resulting string, beginning with a dash, as a command-line argument to ssh. When the caller also supplies a path-valued sftp_server, ssh interprets the malformed host as an option and the server path as its destination, causing the injected ProxyCommand to run locally. This flaw enables execution of arbitrary code with the privileges of the user running SSHFS and can be used to compromise the entire system if the user has administrative rights.

The affected product is the libfuse SSHFS client, versions from 1.4 through 3.7.5 inclusive. Users of any of these versions that allow mounting with bracketed options and supply a path-valued sftp_server are vulnerable. Updating to SSHFS 3.7.6 or later removes the flaw.

The CVSS rating of 7 indicates a high severity for the ability to gain local code execution via credentialed users of SSHFS. No EPSS score is available, so exploitation likelihood is unclear; the CVE is not listed in the CISA KEV catalog. Exploitation requires that the attacker be able to provide an attacker‑controlled mount source to SSHFS, typically by running a wrapper or script that invokes SSHFS with the malicious source. Because the flaw triggers a local command execution before any SSH connection or authentication, it can be used to compromise a system even when the target SSH server is properly secured.