Path traversal in Apache MINA SSHD sshd-scp component (CVE-2026-56452)

A path traversal vulnerability in the sshd-scp component of Apache MINA SSHD allows a malicious sender to supply filenames containing path components in SCP "C" or "D" commands. Because received filenames were not validated, files can be written to attacker-controlled locations on the receiving system. Applications using sshd-scp to receive files are affected regardless of whether they use the 2.x or 3.x release line. Affected versions: - Apache MINA SSHD (org.apache.sshd:sshd-scp) through 2.18.0 - Apache MINA SSHD (org.apache.sshd:sshd-scp) 3.0.0-M1 through 3.0.0-M4 We recommend updating to: 2.19.0, 3.0.0-M5. CVSS 7.5 · our assessment: this_week Reference: https://lists.apache.org/thread/xgoqvmksmd94fsqnzqjdtfjxf35os9no Details: https://vuln.today/cve/CVE-2026-56452