The vulnerability of the SSHFS file system’s client’s find_base_path() function allows a hacker to execute arbitrary commands.

The vulnerability of the findbasepath function in the SSHFS file system lies in the ability to exploit or modify arguments. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...

ALPINE-CVE-2026-48711

SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as -oProxyCommand=CMD:/path and findbasepath removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line...