From 36480181fa22f98e180b4f9e10203480c0346c78 Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Sun, 28 Jun 2026 23:47:16 +0000
Subject: [PATCH] upstream: resist that return ".." via remote glob during

remote/remote copies, similar to fixes for bz3871 for remote/local copies.
From Swival scanner

OpenBSD-Commit-ID: c0c20a1b746db55c08e53658bf21ea9405b300a5
---
 scp.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/scp.c
+++ b/scp.c
@@ -1951,6 +1951,10 @@ throughlocal_sftp(struct sftp_conn *from
 			goto out;
 		}
 
+		/* Special handling for source of '..' */
+		if (strcmp(filename, "..") == 0)
+			filename = "."; /* Download to dest, not dest/.. */
+
 		if (targetisdir)
 			abs_dst = path_append(target, filename);
 		else
