sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.

The publication date reported by the vendor.

The vendor changed the advisory after it was first published.

We collected the advisory from the official source.

Our collector saw this advisory during a later source check.