Libfuse vulnerabilities
We track 3 vulnerabilities in Libfuse products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 19, 2026.
Latest Libfuse vulnerabilities
- 7.0 High severity
sshfs: Improper Neutralization of Argument Delimiters in a Command
SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as [-oProxyCommand=CMD]:/path and find_base_path() removes the brackets, leaving a host value that begins with - and i
- 9.3 Critical severity
sshfs: Improper Link Resolution Before File Access
SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the
- 7.8 High severity
libfuse: Use After Free
libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsystem of libfuse allows a local attacker to crash FUSE filesystem processes and potentially execute arbi