The vulnerability exists in the sftp client component of OpenSSH before version 10.4. When a user connects to an attacker‑controlled SFTP server and requests a file download using the syntax "sftp server:\/path .", the client does not properly constrain the target directory for the downloaded file. The server can supply a malicious file name that includes an arbitrary local path, allowing the client to write the file to any location on the local filesystem. This behavior is categorized by CWE‑22 and CWE‑23 and could result in the creation or overwrite of unintended files, potentially compromising data confidentiality or integrity.

OpenBSD OpenSSH installations running any version earlier than 10.4 are affected. The issue is confined to the sftp client component and has been documented by the OpenSSH developers in the changelog for version 10.4.

The CVSS score of 4.2 indicates a moderate severity, while the EPSS score of < 1% signals a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the victim client to initiate a the malicious file name, the client writes the file to the location specified by the server, potentially allowing the attacker to overwrite user or system files depending on the client's privileges. The attack vector is remote via the SFTP protocol, but the impact is local to the client machine.