Update Info

openSUSE-2026-185


Security update for sshfs


Type: security
Severity: critical
Issued: 2026-06-03
Description:
This update for sshfs fixes the following issues:

- Update to 3.7.6:
  - Added new maintainer: abhinavagarwal07 Abhinav Agarwal
  - CVE-2026-47187: Fixed critical vulnerability - Symlink
    Escape: Rogue SFTP Server to Local File Read/Write), credit
    to abhinavagarwal07 (boo#1267017)
  - New -o contain_symlinks and -o no_contain_symlinks to control
    symlink containment behavior
  - CVE-2026-48711: Fixed high severity vulnerability - Improper
    Neutralization of Argument Delimiters in a Command ('Argument
    Injection'), credit to abhinavagarwal07 (boo#1267016)
  - Fixed null-deref warning in tokenize_on_space, promote
    strict-warnings to required
  - Added a number of tests in CI, including rename, chmod,
    fsync, statvfs values, error paths, option coverage
  - Fixed malformed SFTP reply handling

- Update to 3.7.5:
  * Implement connect to vsock
  * use latest major version for actions/checkout
  * Fix memleak in cache after readlink
  * Fill stat info when returning cached data for readdir
  * ipv6 support for directport connection
- reverts to original fork

- Don't globstar files in shared directory _bindir.

- build the man page


              

Packages


  • sshfs-3.7.6-bp157.2.3.1