sshfs vulnerabilities

2 known vulnerabilities in sshfs from Libfuse. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.0 High severity

  sshfs: Improper Neutralization of Argument Delimiters in a Command

  CVE-2026-48711Aug 19, 2026Libfuse

  SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as [-oProxyCommand=CMD]:/path and find_base_path() removes the brackets, leaving a host value that begins with - and i

• 9.3 Critical severity

  sshfs: Improper Link Resolution Before File Access

  CVE-2026-47187Aug 19, 2026Libfuse

  SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the