PatchTheCVECVE-2019-6111: An issue was discovered in OpenSSH 7.9
CVE-2019-6111 is a medium-severity flaw (CVSS 5.9) affecting openssh, winscp, ubuntu linux. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r)
Why this priority
- EPSS top 1%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.9 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 58.2% (top 1%) |
| CISA exploited list | No |
| Weakness | CWE-22 |
| Published | 2019-01-31 |
| Last modified | 2026-10-14 |
Last updated 2026-10-14 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Exploit-DB: OpenSSH SCP Client - Write Arbitrary Files
- Exploit-DB: SCP Client - Multiple Vulnerabilities (SSHtranger Things)
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2019-6111?
openssh: upgrade to newer than 7.9; winscp: upgrade to newer than 5.1.3; ubuntu linux: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2019-6111 being exploited?
CVE-2019-6111 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2019-6111 affect?
CVE-2019-6111 affects openssh, winscp, ubuntu linux. Severity is medium (CVSS 5.9). An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object nam
How urgent is CVE-2019-6111?
Priority 60/100. EPSS top 1%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action; On your watchlist
Software pages
OpenSSH vulnerabilities · Ubuntu vulnerabilities · Debian vulnerabilities
Related CVEs
- CVE-2026-55655 MEDIUM 5.0 MITIGATE MITIGATE A flaw was found in OpenSSH
- CVE-2026-55653 MEDIUM 4.3 MITIGATE MITIGATE A flaw was found in OpenSSH
- CVE-2026-60002 HIGH 7.7 UPGRADE ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchan
- CVE-2026-60001 MEDIUM 6.5 UPGRADE sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.
- CVE-2026-60000 LOW 3.7 UPGRADE sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from ex