CVE-2026-58624
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Vulnerability in Apache MINA SSHD (sshd-git component) allows an authenticated SSH user to execute arbitrary JGit commands, including writing files to arbitrary locations via `git archive --output`.
Risk Assessment
An attacker can write files to arbitrary locations on the server, potentially leading to privilege escalation or system compromise.
Recommendation
Upgrade Apache MINA SSHD to version 2.19.0 or 3.0.0-M5.
Other vulnerabilities in Apache MINA SSHD
See all- CVE-2022-45047Critical
The class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD versions up to 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. It is one of several implementations that can be used for loading the host keys of an SSH server.
- CVE-2026-56624High
Improper certificate validation in Apache MINA SSHD (server-side). The server did not check for force-command or verify-required options in OpenSSH certificates, allowing an authenticated user to execute other commands than specified. Fixed in versions 2.19.0 and 3.0.0-M5.
- CVE-2026-56623High
A path traversal vulnerability in the sshd-git component of Apache MINA SSHD on Windows allows an authenticated remote user to access git repositories outside the configured server root directory. The fix for CVE-2026-48827 was partially ineffective on Windows.
- CVE-2026-56452High
Path traversal vulnerability in the sshd-scp component of Apache MINA SSHD. A malicious sender can send filenames containing paths, allowing files to be written to arbitrary locations. Affects applications using SCP to receive files.
- CVE-2026-48827High
A path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git operations allows authenticated SSH users to access git repositories outside the configured git server root directory.
Original NVD description (English source)
Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute git commands via the JGit library on git repositories stored on the server. This GitPgmCommandFactory allowed a user authenticated via SSH to run any JGit command available, including commands that could write files at arbitrary places such as git archive with the --output option. Affected are SSH servers implemented with Apache MINA SSHD and using the GitPgmCommandFactory. If the GitPgmCommandFactory is not configured on the server, the server is not affected. It is recommended to upgrade affected servers to Apache MINA SSHD 2.19.0 or 3.0.0-M5, which fix this issue. The issue is fixed by restricting the available commands to a small whitelist of uncritical commands (such as git log). git archive is also allowed, but its --output argument is ignored and the archive is always sent through the SSH channel to the client.