[sshfs] [SECURITY] SSHFS 3.7.6 release fixing 2 vulnerabilities

[H T. <hao...@gm...>]

Hi all,

We have found 2 vulnerabilities in SSHFS (1 Critical, 1 High) and have
patched them in the latest release 3.7.6.
https://github.com/libfuse/sshfs/releases/tag/sshfs-3.7.6

For distro maintainers please test and downstream this release at your
earliest convenience. Both are client side vulnerabilities, one of them
requires a rogue server for exploitation.

See the below changelog:

- - Added new maintainer: abhinavagarwal07 Abhinav Agarwal
- - Fixed critical vulnerability CVE-2026-47187
<https://github.com/libfuse/sshfs/security/advisories/GHSA-pjv6-2c3f-r357>
- Symlink Escape: Rogue SFTP Server to Local File Read/Write), credit to
abhinavagarwal07
- - New -o contain_symlinks and -o no_contain_symlinks to control symlink
containment behavior
- - Fixed high severity vulnerability CVE-2026-48711
<https://github.com/libfuse/sshfs/security/advisories/GHSA-mm85-q63v-4476>
- Improper Neutralization of Argument Delimiters in a Command ('Argument
Injection'), credit to abhinavagarwal07
- - Fixed null-deref warning in tokenize_on_space, promote strict-warnings
to required
- - Added a number of tests in CI, including rename, chmod, fsync, statvfs
values, error paths, option coverage
- - Fixed malformed SFTP reply handling
- - Hardened Github Actions workflow with SHA pins, permissions, timeouts,
and dependabot

Thanks for all your efforts and continued support of SSHFS.