Loading vulnerability…
SSHFS Symlink Escape via Rogue SFTP Server
CVE-2026-47187 is a critical symlink handling vulnerability in SSHFS affecting versions prior to 3.7.6. A malicious or rogue SFTP server can return symlink targets that are absolute paths or relative paths containing parent-directory traversal components. SSHFS passes these server-supplied targets through FUSE to the client kernel for resolution against the local filesystem rather than confining resolution to the mounted remote filesystem view. The flaw is rooted in SSHFS readlink handling, where server-controlled link targets can be copied through unchanged, and the documented transform_symlinks behavior does not safely contain relative traversal targets. As a result, ordinary client-side operations that follow symlinks through the mount can escape the mount root and access local filesystem paths on the client system.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause unauthorized local file disclosure from the client to the rogue server and unauthorized modification of writable local files on the client. Readable local files may be exposed when a user or local tool follows a malicious symlink through the SSHFS mount, while writable local files may be overwritten with attacker-controlled content. This can affect sensitive configuration, startup, or scheduled-task files and may enable persistence or subsequent code execution depending on what local files are modified. The vulnerability has scope change because a remote server can influence access to the client’s local filesystem outside the mounted remote directory.
If you can’t patch tonight, do this now.
Do not mount untrusted or insufficiently verified SFTP servers with vulnerable SSHFS versions. If immediate upgrade is not possible, reduce risk by avoiding workflows and tools that automatically follow symlinks through SSHFS mounts, especially copy, synchronization, backup, and editing operations. Use the symlink containment behavior introduced in fixed releases and do not disable it except for narrowly scoped trusted legacy scenarios. Verifying and strictly trusting remote endpoints reduces exposure, but mitigation short of upgrading is incomplete because the flaw is triggered by server-controlled symlink targets.
Patch, then assume compromise.
Upgrade SSHFS to version 3.7.6 or later. The fix introduces symlink containment logic that rejects absolute symlink targets and targets containing parent-directory components, preventing server-supplied links from escaping the mount root. Where possible, ensure deployments use the fixed default containment behavior rather than legacy pass-through behavior.
No public exploits tracked yet. Mallory keeps watching.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.