The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows…

Published 9 y ago 2017-10-26 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.3

v3.1 · CNA

CISA KEV

not known exploited

EPSS

3.4%

percentile 89%

Public exploits

none known

The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.

CISA SSVC assessment

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 5 mo ago 2026-05-28

Exploit prediction (EPSS)

3.36% probability of exploitation in the next 30 days, higher than 89% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	5.3	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`
NVD	3.1	5.3	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`
CNA	3.1	5.3	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:N/I:P/A:N`

Classification

Weakness

CWE-732 Incorrect Permission Assignment for Critical Resource

References

openssh.com /txt/release-7.6 · x_transferred
securityfocus.com /bid/101552 · vdb-entry, x_transferred
github.com /openbsd/src/commit/a6981567e8e215acc1ef690c8dbb30f2d9b00a19 · x_transferred
security.gentoo.org /glsa/201801-05 · vendor-advisory, x_transferred
security.netapp.com /advisory/ntap-20180423-0004/ · x_transferred
access.redhat.com /errata/RHSA-2018:0980 · vendor-advisory, x_transferred
lists.debian.org /debian-lts-announce/2018/09/msg00010.html · mailing-list, x_transferred
oracle.com /security-alerts/cpujan2020.html · x_transferred
cert-portal.siemens.com /productcert/pdf/ssa-412672.pdf · x_transferred

Sources

CVE List: CVE-2017-15906
NVD: CVE-2017-15906

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary