The reported flaw occurs when the scp command in OpenSSH versions earlier than 10.4 copies a file between two remote hosts. The path handling logic can mistakenly place the copied file inside the parent directory of the intended destination rather than the specified subdirectory. This path traversal vulnerability (CWE‑22 and CWE‑23) can lead to unintended file creation or overwrite in locations such as configuration files or system binaries, but it does not grant arbitrary code execution or broader compromise. The impact is confined to the integrity of files on the target host.

Systems running OpenBSD OpenSSH versions prior to 10.4p1 are affected. Any installation where the version number is less than "10.4" should be examined, and administrators should verify the installed version and plan an upgrade if necessary.

The CVSS score of 4.2 indicates a moderate severity assessment. The EPSS score is reported as less than 1 %, denoting a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The likely attack vector involves a remote attacker who controls or can influence both source and destination hosts for an scp remote‑to‑remote transfer; the attacker would design the transfer to cause the file to be written in the unintended parent directory. This inference is drawn from the nature of the flaw and the requirement of a remote‑to‑remote operation.