Apache MINA SSHD EUVD-2026-46099

Exploitation requires that the target application uses the sshd-scp SCP receive functionality of Apache MINA SSHD (an SSHD server accepting SCP uploads, or an SCP client downloading from a server) on an affected version (<2.0.0, or >=2.0.0 with sshd-scp in use). The attacker must be the SCP sender - meaning in a server-receive deployment they generally hold an authenticated SSH session permitted to run SCP, and in a client-receive deployment the victim must connect to an attacker-controlled/compromised server. Applications on 2.0.0+ that do not include or use sshd-scp are not affected, and SFTP-only deployments are not affected; these are the primary limiting factors that reduce real-world exposure below what the AV:N/PR:N vector alone suggests.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) reflects a network-reachable, low-complexity integrity-only impact with no confidentiality or availability loss, which matches a file-write primitive well. However, the PR:N (unauthenticated) metric warrants scrutiny: SCP runs over an authenticated SSH session, so in a server-receive scenario the malicious sender is typically an authenticated user, while in a client-receive scenario the 'attacker' is the remote server the victim client chose to connect to - in neither case is exploitation truly pre-auth in the usual sense, so the practical privilege requirement is often higher than PR:N implies. No EPSS score, SSVC decision, KEV entry, or POC was provided; absence of these signals plus integrity-only impact suggests this is a meaningful hardening priority for anyone running SCP receivers, but not an emergency mass-exploitation event. The real danger escalates where the written path can reach executable or trusted locations (e.g., web roots, cron, authorized_keys), which can turn a file write into code execution.

A victim application uses Apache MINA SSHD's sshd-scp to receive an upload (or an operator uses an embedded SCP client to pull files from a server). A malicious sender crafts an SCP 'C' command whose filename is a traversal path such as '../../../home/app/.ssh/authorized_keys' or a path into a web root, causing MINA SSHD to write the attacker's content outside the intended directory. Given AV:N/AC:L, this requires only a single crafted SCP transfer with no special timing or user interaction; no public POC was provided.