CVE-2026-58624— Apache MINA SSHD: Remote execution of JGit commands can write files on the server
Quick assessment
Affected
Apache Software Foundation Apache MINA SSHD
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Software Foundation Apache MINA SSHD是Apache Software Foundation基金会的SSH服务器实现库。 Apache MINA SSHD 2.0.0至2.18.0版本和3.0.0-M1至3.0.0-M4版本存在输入验证错误漏洞，该漏洞源于sshd-git组件中的GitPgmCommandFactory允许已通过SSH身份验证的用户执行任意JGit命令，包括通过git archive的--output选项在任意位置写入文件。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache MINA SSHD | 2.0.0≤ 2.18.0 |
affected |
3.0.0-M1≤ 3.0.0-M4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-58624
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache MINA SSHD: Remote execution of JGit commands can write files on the server
Source: CVE Program / CVE List V5
Vulnerability Description
Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH.
Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute git commands via the JGit library on git repositories stored on the server.
This GitPgmCommandFactory allowed a user authenticated via SSH to run any JGit command available, including commands that could write files at arbitrary places such as git archive with the --output option.
Affected are SSH servers implemented with Apache MINA SSHD and using the GitPgmCommandFactory. If the GitPgmCommandFactory is not configured on the server, the server is not affected.
It is recommended to upgrade affected servers to Apache MINA SSHD 2.19.0 or 3.0.0-M5, which fix this issue.
The issue is fixed by restricting the available commands to a small whitelist of uncritical commands (such as git log). git archive is also allowed, but its --output argument is ignored and the archive is always sent through the SSH channel to the client.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Apache MINA SSHD 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Software Foundation Apache MINA SSHD是Apache Software Foundation基金会的SSH服务器实现库。 Apache MINA SSHD 2.0.0至2.18.0版本和3.0.0-M1至3.0.0-M4版本存在输入验证错误漏洞，该漏洞源于sshd-git组件中的GitPgmCommandFactory允许已通过SSH身份验证的用户执行任意JGit命令，包括通过git archive的--output选项在任意位置写入文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache MINA SSHD | 2.0.0 ~ 2.18.0 | - |
|
II. Public POCs for CVE-2026-58624
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-58624
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-58624 (1)
Same Patch Batch · Apache Software Foundation · 2026-07-20 · 10 CVEs total
| CVE-2026-56452 | 7.5 HIGH | Apache MINA SSHD: Path traversal in SCP file reception |
| CVE-2026-56624 | 7.3 HIGH | Apache MINA SSHD: SSH certificate options lack validations |
| CVE-2026-56623 | 7.1 HIGH | Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows |
| CVE-2026-63071 | Apache Syncope: RCE via Groovy Sandbox bypass | |
| CVE-2026-53405 | Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask | |
| CVE-2026-53421 | Apache Syncope: Remote Code Execution via Scripted Connector | |
| CVE-2026-57308 | Apache Syncope: SQL injection vulnerability in Audit Events search | |
| CVE-2026-62183 | Apache Syncope: User self-service privilege escalation | |
| CVE-2026-62418 | Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check |
IV. Related Vulnerabilities
Same product: Apache MINA SSHD
-
CVE-2026-56623
Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git -
CVE-2026-56624
Apache MINA SSHD: SSH certificate options lack validations -
CVE-2026-56452
Apache MINA SSHD: Path traversal in SCP file reception -
CVE-2026-48827
Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git -
CVE-2024-41909
Apache MINA SSHD: integrity check bypass
Same vendor: Apache Software Foundation
-
CVE-2026-70410
Apache Calcite Avatica: Unrestricted class initialization wh -
CVE-2026-94301
Apache MINA: CVE-2026-47065 resolveProxyClass fix missing fr -
CVE-2026-86473
Apache Airflow: Logout ignores a presented Authorization bea -
CVE-2026-75158
Apache Airflow: Assets events API returns asset events for e -
CVE-2026-82355
Apache Airflow: Session cookie silently overrides explicit A
Same weakness: CWE-20
-
CVE-2026-63628
mppx: Gas Draining with access list -
CVE-2026-63627
mppx: Gas Draining with padding -
CVE-2026-81995
Adobe Experience Manager Forms JEE | Improper Input Validati -
CVE-2026-75686
Adobe Connect | Improper Input Validation (CWE-20) -
CVE-2026-75634
CAI Content Credentials | Improper Input Validation (CWE-20)
V. Comments for CVE-2026-58624
No comments yet