An SCP I've been using for a long time to upload files has suddenly stopped working. I ran the script 12 hours ago and it worked just fine, but has suddenly stopped.

The command in question was uploading the current directory to a remote folder:

cd "$(dirname "$0")"

scp -r . <remote_server>:<remote_folder>

The error message is:

scp: error: unexpected filename: .

I'm on a Mac running Mojave 10.14.2.

UPDATE: I have solved the specific problem by rewriting the command to this, but I'd still be interested to know what broke:

scp -r $(pwd) <remote_server>:<remote_folder>
  • I tried on Mojave 10.14.3 and it works. Is the directory empty?
    – Matteo
    Feb 8, 2019 at 11:27
  • Please post your answer separately so you get credit for it and other people will find it. I missed seeing it and is why I posted a near duplicate.
    – AndrewD
    Aug 22, 2019 at 23:32

2 Answers 2


The culprit is CVE-2018-20685, whose description is:

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.

This is part of a larger set of SCP vulnerabilities. Quoting from there:


SCP clients from multiple vendors are susceptible to a malicious scp server performing unauthorized changes to target directory and/or client output manipulation.


Many scp clients fail to verify if the objects returned by the scp server match those it asked for. This issue dates back to 1983 and rcp, on which scp is based. A separate flaw in the client allows the target directory attributes to be changed arbitrarily. Finally, two vulnerabilities in clients may allow server to spoof the client output.

The commit that patched this vulnerability in OpenBSD was made on Nov. 16, 2018

  • 3
    Thanks for the explanation. So my SCP somehow got updated over night to include this patch is why it stopped working? Feb 8, 2019 at 14:31
  • 8
    Making the scp tool unable to process the standard directory entry "." is an AWFUL solution to this! There must be 10's of other ways they could have solved this (perhaps by verifying that the returned objects ARE what was asked for?)... This is "security by the least effort expended", which is next in line after "security by not publishing the hostname"...
    – Haqa
    Feb 12, 2019 at 11:54
  • 3
    Great answer, now I know why my scp scripts on Ubuntu no longer work. But what is the solution? I cannot use * instead of . because the folder contains thousands of files. Is there a new switch to turn off this behaviour?
    – Stéphane
    Feb 12, 2019 at 20:35
  • 3
    @Stéphane use $(pwd) instead of .
    – BlackBear
    Feb 13, 2019 at 7:35
  • 3
    @BlackBear It's not the same. . allow to copy all files (including those starting with a dot) without copying directory itself. scp -r $(pwd) <host>:<dest. dir> and scp -r . <host>:<dest. dir> ARE different. In first case you've got <dest. dir>/<current dir name>/<files list> when you've got <dest. dir>/<files list> with second case.
    – Bil
    Mar 5, 2019 at 8:51

The other answer from @BlackBear explains why this no longer works.

But if like me you ended up on this question also looking for a solution, it seems the right way to do it is with rsync instead of scp. For example, one of my old scp commands would have looked like this:

# this no longer works due to the "."
scp -BCr output/html/. www:/var/www/site/html/

Now instead I use this:

rsync --recursive --times --compress --delete --progress output/html/ www:/var/www/site/html/

If you prefer the shorter flags, it would look like this:

rsync -rtz --del --progress output/html/ www:/var/www/site/html/

The trailing / on the source is important. It tells rsync you want the content of that directory without the directory name.

Also consider --dry-run and man rsync before messing things up.

  • This solution doesn't work for Windows. On Windows only the scp command exists but the rsync doesn't.
    – Spenhouet
    May 20, 2019 at 19:49
  • @besnep If you don't have it, you'll have to install it: google.com/search?q=rsync+for+windows
    – Stéphane
    May 21, 2019 at 23:45
  • The question had already been edited to provide a solution (one without rsync). In summary, replace the . with $(pwd)
    – Jan D
    Nov 10, 2019 at 13:42
  • 2
    @JanD Using $(pwd) doesn't work when you're trying to upload directories that are not the current working directory, which is why I provided the answer I did. Take a look at the very first example in my answer, this is taken verbatim from a script which used the "." notation that scp no longer supports.
    – Stéphane
    Nov 11, 2019 at 1:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .