CVE-2026-56623
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A path traversal vulnerability in the sshd-git component of Apache MINA SSHD on Windows allows an authenticated remote user to access git repositories outside the configured server root directory. The fix for CVE-2026-48827 was partially ineffective on Windows.
Risk Assessment
The risk includes unauthorized access to git repositories, potentially leading to leakage of source code and other sensitive data stored in repositories.
Recommendation
Upgrade Apache MINA SSHD to version 2.19.0 (or 3.0.0-M5 for version 3.0.0). If possible, avoid running the git server on Windows.
Other vulnerabilities in Apache MINA SSHD
See all- CVE-2022-45047Critical
The class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD versions up to 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. It is one of several implementations that can be used for loading the host keys of an SSH server.
- CVE-2026-58624Medium
Vulnerability in Apache MINA SSHD (sshd-git component) allows an authenticated SSH user to execute arbitrary JGit commands, including writing files to arbitrary locations via `git archive --output`.
- CVE-2026-56624High
Improper certificate validation in Apache MINA SSHD (server-side). The server did not check for force-command or verify-required options in OpenSSH certificates, allowing an authenticated user to execute other commands than specified. Fixed in versions 2.19.0 and 3.0.0-M5.
- CVE-2026-56452High
Path traversal vulnerability in the sshd-scp component of Apache MINA SSHD. A malicious sender can send filenames containing paths, allowing files to be written to arbitrary locations. Affects applications using SCP to receive files.
- CVE-2026-48827High
A path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git operations allows authenticated SSH users to access git repositories outside the configured git server root directory.
Original NVD description (English source)
Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories outside of the configured server-side root directory. The path validation applied for CVE-2026-48827 in Apache MINA SSHD 2.18.0 and 3.0.0-M4 was partly ineffective for Servers running on Windows. Applications are affected if they use org.apache.sshd:sshd-git to implement a git server and run on Windows. Applications not using sshd-git or not running on Windows are not affected. Users are advised to upgrade affected applications to Apache MINA SSHD 2.19.0, which fixes the issue. The issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M4 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git and run on Windows. Upgrade affected applications to 3.0.0-M5.