Skip to main content

Apache MINA SSHD CVE-2026-56623

| EUVDEUVD-2026-46104 HIGH
Path Traversal (CWE-22)
2026-07-20 apache GHSA-q57w-g8m3-937c
Apache Java Path Traversal Microsoft Apache Mina Sshd Apache Software Foundation
7.1
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
7.1 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
vuln.today AI
7.1 HIGH

Network-reachable git-over-SSH needs valid credentials (PR:L) and a simple crafted path (AC:L); traversal exposes other repos (C:H) with limited write impact (I:L) and no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None

Lifecycle Timeline

4
Analysis Generated
Jul 20, 2026 - 21:32 vuln.today
Severity Changed
Jul 20, 2026 - 21:22 NVD
MEDIUM HIGH
CVSS changed
Jul 20, 2026 - 21:22 NVD
7.1 (MEDIUM) 7.1 (HIGH)
CVE Published
Jul 20, 2026 - 20:29 cve.org
HIGH 7.1

DescriptionCVE.org

Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH.

A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories outside of the configured server-side root directory. The path validation applied for CVE-2026-48827 in Apache MINA SSHD 2.18.0 and 3.0.0-M4 was partly ineffective for Servers running on Windows.

Applications are affected if they use org.apache.sshd:sshd-git to implement a git server and run on Windows. Applications not using sshd-git or not running on Windows are not affected.

Users are advised to upgrade affected applications to Apache MINA SSHD 2.19.0, which fixes the issue.

The issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M4 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git and run on Windows. Upgrade affected applications to 3.0.0-M5.

Articles & Coverage 4

News 4 New Java Vulnerabilities - 4 High Severity Patched Jul 21, 2026 News 6 New Apache Vulnerabilities - 6 High Severity, No POC Available Jul 21, 2026 News 4 New Java Vulnerabilities - 4 High Severity Jul 20, 2026 News 6 New Apache Vulnerabilities - 6 High Severity Jul 20, 2026

AnalysisAI

Path traversal in Apache MINA SSHD's sshd-git component lets an authenticated remote user on Windows-hosted git servers escape the configured server-side root directory and reach git repositories elsewhere on the filesystem. It is an incomplete-fix regression of CVE-2026-48827: the path validation added in 2.18.0 and 3.0.0-M4 was only partly effective on Windows path semantics. No public exploit identified at time of analysis; not listed in CISA KEV, and no EPSS score was provided.

Technical ContextAI

Apache MINA SSHD is a pure-Java SSH library used to build both SSH clients and servers; the optional sshd-git module implements a git-over-SSH server. The flaw is a CWE-22 Improper Limitation of a Pathname to a Restricted Directory (path traversal). The prior fix (CVE-2026-48827) normalized/validated repository paths against the configured root, but Windows path handling - backslash separators, drive-letter and UNC prefixes, alternate path forms - was not fully covered, so traversal sequences that Windows resolves still slipped past the check. The single CPE provided, cpe:2.3:a:apache_software_foundation:apache_mina_sshd, identifies the library; exposure is limited to deployments that both embed sshd-git and run on Windows.

RemediationAI

Vendor-released patch: upgrade to Apache MINA SSHD 2.19.0 on the stable line, or to 3.0.0-M5 if you are tracking the upcoming 3.0.0 major-version milestones. Because the vulnerability lives in the embedded library, update the org.apache.sshd:sshd-git dependency (and its transitive sshd-core) in your application build and redeploy. If immediate patching is not possible, compensating controls include: restrict git-over-SSH access to trusted, audited accounts and revoke unused SSH keys (reduces the PR:L attacker pool); where feasible, host the sshd-git server on a non-Windows platform, since the flaw does not affect non-Windows deployments; and run the server process under a low-privileged OS account with filesystem ACLs that deny it read access to anything outside the intended repository root, so traversal yields nothing sensitive (trade-off: tighter ACLs may break legitimate repo layouts and require testing). See the advisory at https://lists.apache.org/thread/bhw26snzgvk0mtqqp5dcyjvczp4kcqky.

More in Java

View all
CVE-2012-4681 CRITICAL POC
9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
CVE-2015-7450 CRITICAL POC
9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
CVE-2013-2465 CRITICAL POC
9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2010-1871 HIGH POC
8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
CVE-2012-1723 CRITICAL POC
9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2012-0507 CRITICAL POC
9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
CVE-2015-4852 CRITICAL POC
9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL POC
9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
CVE-2017-3066 CRITICAL POC
9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
CVE-2012-0391 CRITICAL POC
9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected

Share

CVE-2026-56623 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy