Apache MINA SSHD EUVD-2026-46104

Exploitation requires all of the following to hold: the target application must embed the org.apache.sshd:sshd-git module to expose a git-over-SSH server, the server must run on Microsoft Windows (non-Windows hosts are not affected), the running version must be 2.18.0-2.18.x or 3.0.0-M1 through 3.0.0-M4, and the attacker must possess valid SSH credentials to authenticate (CVSS PR:L - authenticated). Given those, the attacker sends a git request with a crafted path whose Windows-specific traversal sequences defeat the incomplete CVE-2026-48827 validation. Limiting factors that reduce real-world exposure: the Windows-only requirement, the specific sshd-git deployment mode, the need for prior authentication, and the affected version window - a fully patched (2.19.0 / 3.0.0-M5) or Linux/Unix deployment is not exploitable.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, base 7.1) indicates a network-reachable, low-complexity attack requiring only low-privilege authentication, yielding high confidentiality and low integrity impact with no availability effect - consistent with an authenticated user reading (and to a limited degree writing/affecting) repositories outside the intended root. Real-world risk is meaningfully bounded by two conditions that CVSS does not fully capture: the target must run on Windows AND use sshd-git, and the attacker must already hold valid SSH credentials (PR:L). No KEV listing and no EPSS value were supplied, and no POC is referenced, so there is no evidence of active or imminent exploitation; treat this as an authenticated, opportunistic information-disclosure risk rather than a mass-exploitation event. No signals are directly conflicting, but the absence of EPSS/POC data means exploitation likelihood is inferred, not measured.

An attacker who already has valid, low-privilege SSH credentials to a Windows-hosted git server built on sshd-git issues a git operation referencing a crafted repository path containing Windows-style traversal sequences. The path validation fails to normalize the Windows path, so the request resolves to a repository outside the configured root, letting the attacker clone or read git repositories they were never authorized to access. No public POC is referenced, and the low attack complexity (AC:L) means the crafted request is straightforward once traversal semantics are known.