Apache Mina Sshd
Monthly
Path traversal in Apache MINA SSHD's sshd-git component lets an authenticated remote user on Windows-hosted git servers escape the configured server-side root directory and reach git repositories elsewhere on the filesystem. It is an incomplete-fix regression of CVE-2026-48827: the path validation added in 2.18.0 and 3.0.0-M4 was only partly effective on Windows path semantics. No public exploit identified at time of analysis; not listed in CISA KEV, and no EPSS score was provided.
Command-restriction bypass in Apache MINA SSHD (server-side) lets a user who authenticates with an OpenSSH user certificate carrying a force-command directive execute arbitrary commands instead of the single restricted command the certificate authority intended. The server accepts and honors such certificates but silently ignores the force-command and verify-required options, breaking the security model that certificate issuers rely on to constrain principals. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is confirmed and fixed by the Apache Software Foundation in versions 2.19.0 and 3.0.0-M5.
Arbitrary file write in Apache MINA SSHD's sshd-scp component lets a malicious SCP sender place files outside the intended download directory because filenames in SCP 'C' (file) and 'D' (directory) commands are not validated for path separators. Any application acting as an SCP receiver - either an SSHD server accepting uploads or an SCP client fetching from a server - using unsupported versions <2.0.0 or the sshd-scp module in >=2.0.0 is affected, allowing an attacker to overwrite or plant files in attacker-chosen locations. Reported by Apache; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file write in Apache MINA SSHD's sshd-git component enables any SSH-authenticated user to write files to arbitrary server filesystem paths via the JGit git archive --output argument. Servers are only affected when explicitly configured with GitPgmCommandFactory; the vulnerability does not exist in default MINA SSHD deployments. No public exploit code or CISA KEV listing exists at time of analysis; vendor-confirmed fixes are available in versions 2.19.0 and 3.0.0-M5.
Path traversal in Apache MINA SSHD's sshd-git component lets an authenticated remote user on Windows-hosted git servers escape the configured server-side root directory and reach git repositories elsewhere on the filesystem. It is an incomplete-fix regression of CVE-2026-48827: the path validation added in 2.18.0 and 3.0.0-M4 was only partly effective on Windows path semantics. No public exploit identified at time of analysis; not listed in CISA KEV, and no EPSS score was provided.
Command-restriction bypass in Apache MINA SSHD (server-side) lets a user who authenticates with an OpenSSH user certificate carrying a force-command directive execute arbitrary commands instead of the single restricted command the certificate authority intended. The server accepts and honors such certificates but silently ignores the force-command and verify-required options, breaking the security model that certificate issuers rely on to constrain principals. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is confirmed and fixed by the Apache Software Foundation in versions 2.19.0 and 3.0.0-M5.
Arbitrary file write in Apache MINA SSHD's sshd-scp component lets a malicious SCP sender place files outside the intended download directory because filenames in SCP 'C' (file) and 'D' (directory) commands are not validated for path separators. Any application acting as an SCP receiver - either an SSHD server accepting uploads or an SCP client fetching from a server - using unsupported versions <2.0.0 or the sshd-scp module in >=2.0.0 is affected, allowing an attacker to overwrite or plant files in attacker-chosen locations. Reported by Apache; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file write in Apache MINA SSHD's sshd-git component enables any SSH-authenticated user to write files to arbitrary server filesystem paths via the JGit git archive --output argument. Servers are only affected when explicitly configured with GitPgmCommandFactory; the vulnerability does not exist in default MINA SSHD deployments. No public exploit code or CISA KEV listing exists at time of analysis; vendor-confirmed fixes are available in versions 2.19.0 and 3.0.0-M5.