EUVD-2026-46101
GHSA-7229-w5mh-32hm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Arbitrary file write to any OS-accessible path warrants I:H; SSH authentication is mandatory (PR:L); no confidentiality or availability impact is described.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
4DescriptionCVE.org
Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH.
Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute git commands via the JGit library on git repositories stored on the server.
This GitPgmCommandFactory allowed a user authenticated via SSH to run any JGit command available, including commands that could write files at arbitrary places such as git archive with the --output option.
Affected are SSH servers implemented with Apache MINA SSHD and using the GitPgmCommandFactory. If the GitPgmCommandFactory is not configured on the server, the server is not affected.
It is recommended to upgrade affected servers to Apache MINA SSHD 2.19.0 or 3.0.0-M5, which fix this issue.
The issue is fixed by restricting the available commands to a small whitelist of uncritical commands (such as git log). git archive is also allowed, but its --output argument is ignored and the archive is always sent through the SSH channel to the client.
AnalysisAI
Arbitrary file write in Apache MINA SSHD's sshd-git component enables any SSH-authenticated user to write files to arbitrary server filesystem paths via the JGit git archive --output argument. Servers are only affected when explicitly configured with GitPgmCommandFactory; the vulnerability does not exist in default MINA SSHD deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the attacker must hold a valid SSH account on the target server - CVSS PR:L confirms authentication is mandatory and no unauthenticated path exists; (2) the server must be explicitly configured to use GitPgmCommandFactory from org.apache.sshd:sshd-git - this is a non-default, opt-in deployment choice and is the single most significant limiting factor, as all standard MINA SSHD deployments are entirely unaffected; (3) the SSH-authenticated user must have network connectivity to the SSH port. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) correctly reflects network accessibility and required SSH authentication (PR:L), but the Integrity:Low rating likely understates real-world impact for deployments where the SSH process has write access to sensitive paths such as ~/.ssh/authorized_keys, git hook directories, or web roots - scenarios common in self-hosted git infrastructure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with valid SSH credentials connects to a MINA SSHD server configured with GitPgmCommandFactory and issues a git archive --output=/home/git/.ssh/authorized_keys HEAD command, overwriting the server's authorized_keys file with attacker-controlled content and gaining persistent SSH access without credentials. No public exploit code has been identified, but the attack requires only standard SSH and git client tooling available on any developer workstation. |
| Remediation | Upgrade to Apache MINA SSHD 2.19.0 (stable) or 3.0.0-M5 (milestone), which are the vendor-confirmed fixed releases per the advisory at https://lists.apache.org/thread/7c3cry6pdy6hj1q0f28rc72x4o4tlyjo. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today