Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-56623— Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows

CVSS 7.1 · High EPSS 0.59% · P46

Affected Version Matrix 2

VendorProductVersion RangeStatus
Apache Software FoundationApache MINA SSHD2.0.0≤ 2.18.0affected
3.0.0-M1≤ 3.0.0-M4affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-56623

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows
Source: CVE Program / CVE List V5
Vulnerability Description
Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories outside of the configured server-side root directory. The path validation applied for CVE-2026-48827 in Apache MINA SSHD 2.18.0 and 3.0.0-M4 was partly ineffective for Servers running on Windows. Applications are affected if they use org.apache.sshd:sshd-git to implement a git server and run on Windows. Applications not using sshd-git or not running on Windows are not affected. Users are advised to upgrade affected applications to Apache MINA SSHD 2.19.0, which fixes the issue. The issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M4 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git and run on Windows. Upgrade affected applications to 3.0.0-M5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache MINA SSHD 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Software Foundation Apache MINA SSHD是Apache Software Foundation基金会的SSH服务器实现库。 Apache MINA SSHD 2.18.0及之前版本和3.0.0-M1至3.0.0-M4版本存在路径遍历漏洞，该漏洞源于Windows上的路径遍历，可能导致经身份验证的远程用户访问配置的服务器端根目录之外的git仓库。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
Apache Software FoundationApache MINA SSHD 2.0.0 ~ 2.18.0 -

II. Public POCs for CVE-2026-56623

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-56623

请登录查看更多情报信息。

Mailing List Discussions for CVE-2026-56623 (1)

Same Patch Batch · Apache Software Foundation · 2026-07-20 · 10 CVEs total

CVE-2026-564527.5 HIGHApache MINA SSHD: Path traversal in SCP file reception
CVE-2026-566247.3 HIGHApache MINA SSHD: SSH certificate options lack validations
CVE-2026-586245.4 MEDIUMApache MINA SSHD: Remote execution of JGit commands can write files on the server
CVE-2026-63071Apache Syncope: RCE via Groovy Sandbox bypass
CVE-2026-53405Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
CVE-2026-53421Apache Syncope: Remote Code Execution via Scripted Connector
CVE-2026-57308Apache Syncope: SQL injection vulnerability in Audit Events search
CVE-2026-62183Apache Syncope: User self-service privilege escalation
CVE-2026-62418Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check

IV. Related Vulnerabilities

Same product: Apache MINA SSHD
Same vendor: Apache Software Foundation
Same weakness: CWE-22

V. Comments for CVE-2026-56623

No comments yet

Leave a comment