CVE-2026-48711

Name	CVE-2026-48711
Description	SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as [-oProxyCommand=CMD]:/path and find_base_path() removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line argument. When a caller also supplies a path-valued sftp_server, ssh treats the normalized host as an option and the server path as its destination, causing an injected ProxyCommand to execute locally before any connection or authentication succeeds. The attack requires a caller or wrapper that passes an attacker-controlled mount source to SSHFS with the required sftp_server configuration and results in arbitrary command execution as the user running SSHFS. This issue is fixed in version 3.7.6.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1138293

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
sshfs-fuse (PTS)	bullseye	3.7.1+repack-2	vulnerable
	bookworm	3.7.3-1.2~deb12u1	fixed
	trixie	3.7.3-1.2~deb13u1	fixed
	forky, sid	3.7.3-1.2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
sshfs-fuse	source	bookworm	3.7.3-1.2~deb12u1
sshfs-fuse	source	trixie	3.7.3-1.2~deb13u1
sshfs-fuse	source	(unstable)	3.7.3-1.2	1138293

Notes

[bullseye] - sshfs-fuse <postponed> (Minor issue)
https://www.openwall.com/lists/oss-security/2026/05/30/3
https://github.com/libfuse/sshfs/security/advisories/GHSA-mm85-q63v-4476
https://github.com/libfuse/sshfs/pull/362
Fixed by: https://github.com/libfuse/sshfs/commit/6678accb85ea4aec15dae9961b92af8d12501a66 (sshfs-3.7.6)