CVE-2026-56623

Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories outside of the configured server-side root directory. The path validation applied for CVE-2026-48827 in Apache MINA SSHD 2.18.0 and 3.0.0-M4 was partly ineffective for Servers running on Windows. Applications are affected if they use org.apache.sshd:sshd-git to implement a git server and run on Windows. Applications not using sshd-git or not running on Windows are not affected. Users are advised to upgrade affected applications to Apache MINA SSHD 2.19.0, which fixes the issue. The issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M4 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git and run on Windows. Upgrade affected applications to 3.0.0-M5.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/bhw26snzgvk0mtqqp5dcyjvczp4kcqky	Vendor Advisory Mailing List

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:apache:mina_sshd::::::::
	cpe:2.3:a:apache:mina_sshd:3.0.0:m1::::::
	cpe:2.3:a:apache:mina_sshd:3.0.0:m2::::::
	cpe:2.3:a:apache:mina_sshd:3.0.0:m3::::::
	cpe:2.3:a:apache:mina_sshd:3.0.0:m4::::::

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-07-20 21:16

Updated : 2026-07-27 13:50

NVD link : CVE-2026-56623

Mitre link : CVE-2026-56623

CVE.ORG link : CVE-2026-56623

JSON object : View

Products Affected

apache

mina_sshd

microsoft

windows

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-56623", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56623", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T17:07:35.150777Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@apache.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache MINA SSHD", "versions": [{"status": "affected", "version": "2.0.0", "versionType": "maven", "lessThanOrEqual": "2.18.0"}, {"status": "affected", "version": "3.0.0-M1", "versionType": "maven", "lessThanOrEqual": "3.0.0-M4"}], "packageName": "org.apache.sshd:sshd-git", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-07-20T21:16:48.947", "references": [{"url": "https://lists.apache.org/thread/bhw26snzgvk0mtqqp5dcyjvczp4kcqky", "tags": ["Vendor Advisory", "Mailing List"], "source": "security@apache.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Path traversal on Windows in Apache MINA SSHD component sshd-git.\u00a0Apache MINA SSHD is a Java library for client-side and server-side SSH.\n\n\n\n\nA git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories outside of the configured server-side root directory. The path validation applied for\u00a0CVE-2026-48827 in Apache MINA SSHD 2.18.0 and 3.0.0-M4 was partly ineffective for Servers running on Windows.\n\n\n\n\nApplications are affected if they use org.apache.sshd:sshd-git to implement a git server and run on Windows. Applications not using sshd-git or not running on Windows are not affected.\n\n\n\n\nUsers are advised to upgrade affected applications to Apache MINA SSHD 2.19.0, which fixes the issue.\n\n\n\n\nThe issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M4 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git and run on Windows. Upgrade affected applications to 3.0.0-M5."}], "lastModified": "2026-07-27T13:50:42.327", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:mina_sshd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "93103A71-FB42-4C50-8529-232D40EAD7DD", "versionEndExcluding": "2.19.0", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:apache:mina_sshd:3.0.0:m1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "32435A6F-3BD6-4AAB-93B1-0B1514419A50"}, {"criteria": "cpe:2.3:a:apache:mina_sshd:3.0.0:m2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E399FD6-9A33-4F78-AFCE-F46C7BBC56F1"}, {"criteria": "cpe:2.3:a:apache:mina_sshd:3.0.0:m3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13419EBE-E6B4-4895-BF6C-FC910076CC7A"}, {"criteria": "cpe:2.3:a:apache:mina_sshd:3.0.0:m4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B2D4A4D-BEF5-416F-91AD-B4F278B04C76"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@apache.org"}