Remote code execution via unchecked SCP filenames

External path control in Microsoft OpenSSH for Windows allows remote authenticated users to execute code via crafted SCP filenames. During recursive copies, scp accepts filenames containing invalid path characters instead of rejecting them, allowing a hostile SSH endpoint to direct writes outside the intended transfer tree. Exploitation requires low privileges and a user to start a recursive SCP transfer, after which attacker-selected file writes can lead to code execution.