Comment by mfontani

I read:

* [...] only directory traversal attacks are prevented

* [...] can overwrite arbitrary files in the scp client target directory

* [...] the server can manipulate subdirectories as well

... so nothing points to the ability of the server to "fiddle with" parent directories.

Thus.. Is it an OK temporary workaround to _only_ perform scp from within a freshly created directory in /tmp/?