SSHFS is a network filesystem client that allows a local user to mount a remote directory over SSH. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as [-oProxyCommand=CMD]:/path. The find_base_path() routine removes the brackets, leaving a host value that begins with a dash and is passed directly to the ssh command. When a caller also supplies a path‑valued sftp_server, ssh treats the normalized host as an option and the server path as its destination, causing an injected ProxyCommand to execute locally before any connection or authentication succeeds. The attacker must provide an attacker‑controlled mount source to SSHFS using a wrapper or script, and this results in arbitrary command execution as the user running SSHFS. The issue is fixed in SSHFS 3.7.6.

The affected product is the libfuse SSHFS client, versions from 1.4 through 3.7.5 inclusive. Users of any of these versions that allow mounting with bracketed options and supply a path‑valued sftp_server are vulnerable. Updating to SSHFS 3.7.6 or later removes the flaw.

The CVSS score of 7 indicates a high severity level for local code execution. The EPSS score is less than 1 %, suggesting a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to be able to supply a malicious mount source to SSHFS—typically by running a wrapper or script that invokes SSHFS with the special bracketed syntax. Because the injected ProxyCommand executes locally before any SSH connection or authentication, the flaw can lead to arbitrary command execution as the SSHFS user even when the target SSH server is properly secured.