GHSA-jgqr-738j-43cgHighCVSS 7.5

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome...

Published
April 2, 2026
Last Modified
August 25, 2026

🔗 CVE IDs covered (1)

CVE-2026-35385 →

📋 Description

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).

🔗 References (38)