CVE-2006-0225: OpenBSD OpenSSH

Medium severity, CVSS 4.6. EPSS: 0.5% chance of exploitation in the next 30 days.

scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.

Affected products

• OpenBSD OpenSSH: version 3.0 only; version 3.0.1 only; version 3.0.1p1 only; version 3.0.2 only; version 3.0.2p1 only; version 3.0p1 only; …

Published 2006-01-25. Last modified 2026-06-16.