sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
1:7.5p1-101:7.5p1-81:7.5p1-91:7.5p1-9build11:7.5p1-11build11:8.9p1-3ubuntu0.161:7.5p1-121:7.5p1-12build11:7.5p1-131:9.6p1-3ubuntu13.181:7.5p1-141:7.5p1-151:7.5p1-15build11:7.5p1-161:10.0p1-5ubuntu21:10.0p1-5ubuntu31:10.0p1-5ubuntu41:10.0p1-5ubuntu51:10.0p1-5ubuntu5.11:10.0p1-5ubuntu5.41:9.9p1-3ubuntu31:9.9p1-3ubuntu3.11:7.5p1-171:10.2p1-2ubuntu3.41:7.5p1-171:7.5p1-18Exploitability
AV:NAC:HPR:NUI:RScope
S:UImpact
C:NI:LA:LCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L