Description

SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as [-oProxyCommand=CMD]:/path and find_base_path() removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line argument. When a caller also supplies a path-valued sftp_server, ssh treats the normalized host as an option and the server path as its destination, causing an injected ProxyCommand to execute locally before any connection or authentication succeeds. The attack requires a caller or wrapper that passes an attacker-controlled mount source to SSHFS with the required sftp_server configuration and results in arbitrary command execution as the user running SSHFS. This issue is fixed in version 3.7.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-08-19T15:17:05.580Z",
  "pubdate": "2026-08-19T15:17:05.580Z",
  "executiveSummary": "An arbitrary command execution vulnerability exists in the SSHFS network filesystem client affecting versions from 1.4 up to 3.7.6. The flaw arises from improper handling of bracketed mount source inputs, which allows attackers to pass a crafted host value beginning with a hyphen directly to the underlying ssh command-line interface. By leveraging this argument injection alongside a caller-supplied path-valued sftp_server configuration, an attacker can coerce ssh into treating the normalized host as an option and the server path as its destination. This results in the execution of an injected ProxyCommand locally on the host system prior to any network connection or authentication procedures. The impact is severe, leading to arbitrary command execution under the privileges of the user running SSHFS. Successful exploitation requires an attacker-controlled mount source to be passed to SSHFS by a caller or wrapper, combined with the required sftp_server configuration.",
  "technicalDetails": "The vulnerability resides in the find_base_path() function of SSHFS, which processes mount source inputs. Specifically, when SSHFS receives a bracketed mount source formatted such as [-oProxyCommand=CMD]:/path, the function strips the surrounding brackets. This stripping mechanism leaves behind a host value that begins with a hyphen character (-), which is subsequently passed directly to the underlying ssh binary as a command-line argument without adequate sanitization or validation.\nThe root cause is a classic command-line argument injection vulnerability stemming from insufficient input parsing and boundary enforcement between positional arguments and command flags in the argument passing vector to ssh. When a caller or wrapper provides an attacker-controlled mount source containing an option injection payload alongside a path-valued sftp_server configuration, the ssh utility misinterprets the normalized host string as a command-line option rather than a destination hostname.\nThe attack flow proceeds sequentially: first, the attacker supplies a maliciously crafted mount source containing command injection payloads via a wrapper or caller interface interacting with SSHFS. Second, SSHFS processes the input through find_base_path(), removing the brackets and yielding a hostile string beginning with a hyphen. Third, SSHFS invokes the ssh command, passing this string where a hostname is expected. Fourth, because a path-valued sftp_server is configured, ssh parses the injected string as an option and the server path as the destination argument. Finally, this misinterpretation forces ssh to evaluate and execute the injected ProxyCommand locally on the victim system before initiating any remote network connection or authentication handshake.\nThe affected component is the mount source parsing logic within the SSHFS client, specifically impacting all versions from 1.4 through 3.7.6. The vulnerability requires no authentication or network exposure to exploit, as it executes locally on the target system; however, it strictly requires the presence of a caller or wrapper mechanism that feeds the attacker-controlled mount source into SSHFS alongside the specific sftp_server configuration. The post-exploitation impact includes full arbitrary command execution constrained only by the privileges of the local user running the SSHFS process."
}