OpenSSH sftp download path restriction bypass (CVE-2026-59995)

Summary

A malicious SFTP server may influence where downloaded files are placed.

Vulnerability ID	Vulnerability Overview
CVE-2026-59995	When the client uses sftp server:/path . against an attacker-controlled server, download destinations are not sufficiently constrained. Files may be placed outside the intended location.

Affected Supported TeraStations

TS5020 / TS3030
- Fixed in firmware version 3.16
 

 

Back to Security Notices

Date	Description
10/14/2026	Initial release

Back to Security Notices