Apache MINA SSHD EUVD-2026-89755

Requires the server to be configured with the sshd-git component's GitPgmCommandFactory so that authenticated SSH clients can remotely execute JGit git commands against repositories on the server - this is an optional, non-default deployment mode. The attacker must also possess valid SSH credentials (PR:L), so exploitation is limited to authenticated users. Given those conditions, exploitation is remote, low-complexity, and requires no user interaction: the attacker simply invokes 'git archive' with the single-argument '-o=file.zip' form, which the incomplete CVE-2026-58624 fix fails to block. Deployments not exposing remote git command execution are not affected.

This is a genuine but conditional integrity issue rather than a widespread panic-worthy flaw. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, 6.5 medium) indicates network-reachable, low-complexity exploitation but requires authenticated access (PR:L) - an attacker must already hold valid SSH credentials on the server. The impact is scoped purely to integrity (I:H, arbitrary file write on the server) with no confidentiality or availability effect claimed. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' Critically, exploitation is gated by a specific deployment choice: the server must be configured to expose GitPgmCommandFactory so authenticated SSH clients can run JGit git commands. This is a regression - the prior fix for CVE-2026-58624 restricted the allowed command set but missed the single-argument '-o=file.zip' form of 'git archive', so the mitigation is incomplete rather than a brand-new class of bug. Overall this is a real priority for the narrow set of deployments running sshd-git with remote git command execution enabled, and low practical risk elsewhere.

An attacker who holds valid SSH credentials to a server running Apache MINA SSHD with the sshd-git GitPgmCommandFactory enabled connects and issues a 'git archive -o=output.zip' command. Because the CVE-2026-58624 fix failed to strip the single-argument '-o=file.zip' form, JGit writes the resulting archive to an attacker-chosen path on the server filesystem instead of streaming it back over the SSH connection. No public exploit code is identified, but the technique is trivial to reproduce given the description.