CVE-2026-56452
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Path traversal vulnerability in the sshd-scp component of Apache MINA SSHD. A malicious sender can send filenames containing paths, allowing files to be written to arbitrary locations. Affects applications using SCP to receive files.
Risk Assessment
Risk of writing files to unauthorized locations, potentially leading to system compromise or privilege escalation.
Recommendation
Upgrade Apache MINA SSHD to version 2.19.0 or 3.0.0-M5. If not using sshd-scp, you are not affected.
Other vulnerabilities in Apache MINA SSHD
See all- CVE-2022-45047Critical
The class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD versions up to 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. It is one of several implementations that can be used for loading the host keys of an SSH server.
- CVE-2026-58624Medium
Vulnerability in Apache MINA SSHD (sshd-git component) allows an authenticated SSH user to execute arbitrary JGit commands, including writing files to arbitrary locations via `git archive --output`.
- CVE-2026-56624High
Improper certificate validation in Apache MINA SSHD (server-side). The server did not check for force-command or verify-required options in OpenSSH certificates, allowing an authenticated user to execute other commands than specified. Fixed in versions 2.19.0 and 3.0.0-M5.
- CVE-2026-56623High
A path traversal vulnerability in the sshd-git component of Apache MINA SSHD on Windows allows an authenticated remote user to access git repositories outside the configured server root directory. The fix for CVE-2026-48827 was partially ineffective on Windows.
- CVE-2026-48827High
A path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git operations allows authenticated SSH users to access git repositories outside the configured git server root directory.
Original NVD description (English source)
Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places. The issue affects only * applications that use no longer supported Apache MINA SSHD versions < 2.0.0 and use the SCP functions to receive files, * or applications using sshd-scp in Apache MINA SSHD >= 2.0.0 to receive files. Applications using Apache MINA SSHD >= 2.0.0 not using sshd-scp are not affected. The issue is fixed in Apache MINA 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to these versions.