What is the CVSS score of CVE-2026-56452?

CVE-2026-56452 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Apache MINA SSHD are affected by CVE-2026-56452?

Apache MINA SSHD's sshd-scp component (versions <2.0.0 and the module in ≥2.0.0) contains an arbitrary file write vulnerability allowing SCP senders to bypass directory restrictions and place files…

How to fix or mitigate CVE-2026-56452?

Within 24 hours: Identify all applications and systems using Apache MINA SSHD's sshd-scp component and assess their exposure level and operational criticality. Within 7 days: Implement strict input validation on all SCP filenames to reject path separators and traversal sequences, restrict SCP sender access to trusted principals only, and deploy monitoring for suspicious file write attempts to unintended locations. Within 30 days: Evaluate upgrades to patched MINA SSHD versions if available, migrate to SFTP with enhanced path validation, or implement permanent application-layer filename canonicalization and validation controls.

Apache MINA SSHD CVE-2026-56452

Q: How to fix or mitigate CVE-2026-56452?

Within 24 hours: Identify all applications and systems using Apache MINA SSHD's sshd-scp component and assess their exposure level and operational criticality. Within 7 days: Implement strict input validation on all SCP filenames to reject path separators and traversal sequences, restrict SCP sender access to trusted principals only, and deploy monitoring for suspicious file write attempts to unintended locations. Within 30 days: Evaluate upgrades to patched MINA SSHD versions if available, migrate to SFTP with enhanced path validation, or implement permanent application-layer filename canonicalization and validation controls.

EUVD-2026-46099 HIGH

Path Traversal (CWE-22)

2026-07-20 apache

GHSA-2vf2-jm4x-2gj4

Apache Java Path Traversal Apache Mina Sshd Apache Software Foundation

7.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network SCP over an authenticated SSH session implies PR:L rather than PR:N; low complexity, integrity-only file-write so C:N/A:N and I:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 21:30 vuln.today

Severity Changed

Jul 20, 2026 - 21:22 NVD

MEDIUM HIGH

CVSS changed

Jul 20, 2026 - 21:22 NVD

7.5 (MEDIUM) 7.5 (HIGH)

CVE Published

Jul 20, 2026 - 20:26 cve.org

HIGH 7.5

DescriptionCVE.org

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH.

The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places.

The issue affects only

applications that use no longer supported Apache MINA SSHD versions < 2.0.0 and use the SCP functions to receive files,
or applications using sshd-scp in Apache MINA SSHD >= 2.0.0 to receive files.

Applications using Apache MINA SSHD >= 2.0.0 not using sshd-scp are not affected.

The issue is fixed in Apache MINA 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to these versions.

Articles & Coverage 4

News 4 New Java Vulnerabilities - 4 High Severity Patched Jul 21, 2026 News 6 New Apache Vulnerabilities - 6 High Severity, No POC Available Jul 21, 2026 News 4 New Java Vulnerabilities - 4 High Severity Jul 20, 2026 News 6 New Apache Vulnerabilities - 6 High Severity Jul 20, 2026

AnalysisAI

Arbitrary file write in Apache MINA SSHD's sshd-scp component lets a malicious SCP sender place files outside the intended download directory because filenames in SCP 'C' (file) and 'D' (directory) commands are not validated for path separators. Any application acting as an SCP receiver - either an SSHD server accepting uploads or an SCP client fetching from a server - using unsupported versions <2.0.0 or the sshd-scp module in >=2.0.0 is affected, allowing an attacker to overwrite or plant files in attacker-chosen locations. Reported by Apache; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Apache MINA SSHD is a pure-Java SSH library used to embed client and server SSH functionality into JVM applications, and its optional sshd-scp module implements the legacy SCP (secure copy) protocol layered over SSH. In SCP, the sending peer transmits control messages beginning with 'C' (a regular file, with mode, length, and name) and 'D' (a directory), and the receiver is expected to treat the name as a single path component within the current target directory. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the receive implementation trusted the sender-supplied filename verbatim, so names containing '/' or '../' sequences caused writes to be resolved outside the destination. The affected component is identified by CPE cpe:2.3:a:apache_software_foundation:apache_mina_sshd, and the flaw is specific to the SCP receive code path rather than the core transport or SFTP.

RemediationAI

Vendor-released patch: upgrade to Apache MINA SSHD 2.19.0 (2.x branch) or 3.0.0-M5 (3.x milestone) as directed by the Apache advisory at https://lists.apache.org/thread/xgoqvmksmd94fsqnzqjdtfjxf35os9no; this is the primary and recommended action, and it removes support for the vulnerable pre-2.0.0 line entirely. If you cannot upgrade immediately and you operate an SCP receiver, disable or remove the sshd-scp module and rely on SFTP instead, since SFTP is not affected - the trade-off is that legacy SCP clients will stop working. As a compensating control for embedded receivers, run the receiving process under a low-privilege account chrooted or confined to a dedicated directory and validate/normalize incoming filenames (reject any name containing '/' or '..') before writing, accepting that custom validation is error-prone compared to the official fix. For client use, avoid SCP-fetching files from untrusted or unauthenticated servers.

More in Java

View all

CVE-2012-4681 CRITICAL Emergency POC

9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m

CVE-2015-7450 CRITICAL Emergency POC

9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti

CVE-2013-2465 CRITICAL Act Now POC

9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent

CVE-2011-3544 CRITICAL Act Now POC

9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug

CVE-2010-1871 HIGH Act Now POC

8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to

CVE-2012-1723 CRITICAL Emergency POC

9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up

CVE-2013-0422 CRITICAL Emergency POC

9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using

CVE-2012-0507 CRITICAL Emergency POC

9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up

CVE-2015-4852 CRITICAL Act Now POC

9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL Act Now POC

9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow

CVE-2017-3066 CRITICAL Act Now POC

9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla

CVE-2012-0391 CRITICAL Act Now POC

9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-22 – Path Traversal

View all

CVE-2019-3396 CRITICAL POC

9.8

CVE-2019-19781 CRITICAL POC

9.8

CVE-2020-5902 CRITICAL POC

9.8

CVE-2021-21972 CRITICAL POC

9.8

CVE-2021-40444 HIGH POC

8.8

CVE-2022-41352 CRITICAL POC

9.8

CVE-2021-27065 HIGH POC

7.8

CVE-2019-11510 CRITICAL POC

10.0

Same technique Path Traversal

View all

CVE-2019-19781 CRITICAL POC

9.8

CVE-2021-21972 CRITICAL POC

9.8

CVE-2021-40444 HIGH POC

8.8

CVE-2022-41352 CRITICAL POC

9.8

CVE-2021-27065 HIGH POC

7.8

CVE-2018-20250 HIGH POC

7.8

CVE-2022-37042 CRITICAL POC

9.8

CVE-2025-64446 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected

CVE-2026-56452 vulnerability details – vuln.today

Back

Apache MINA SSHD CVE-2026-56452

Severity by source

CVSS VectorVendor: apache

Lifecycle Timeline

DescriptionCVE.org

Articles & Coverage 4

AnalysisAI

Technical ContextAI

RemediationAI

More in Java

Same weakness CWE-22 – Path Traversal

Same technique Path Traversal

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code