Path traversal in Apache MINA SSHD sshd-git on Windows (CVE-2026-56623)

A path traversal vulnerability in the sshd-git component of Apache MINA SSHD allows an authenticated remote user to access git repositories outside the configured server-side root directory when the server runs on Windows. The path validation introduced to address CVE-2026-48827 in versions 2.18.0 and 3.0.0-M4 was partly ineffective on Windows. Only applications using org.apache.sshd:sshd-git to implement a git server and running on Windows are affected. Affected versions: - Apache MINA SSHD (org.apache.sshd:sshd-git) 2.0.0 through 2.18.0 - Apache MINA SSHD (org.apache.sshd:sshd-git) 3.0.0-M1 through 3.0.0-M4 We recommend updating to: 2.19.0, 3.0.0-M5. CVSS 7.1 · our assessment: this_week Reference: https://lists.apache.org/thread/bhw26snzgvk0mtqqp5dcyjvczp4kcqky Details: https://vuln.today/cve/CVE-2026-56623