CVE-2026-56623
published 2026-07-20CVE-2026-56623: Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server…
PriorityP344high7.1CVSS 3.1
AVNACLPRLUINSUCHILAN
EPSS
0.33%
25.2th percentile
Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH.
A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories outside of the configured server-side root directory. The path validation applied for CVE-2026-48827 in Apache MINA SSHD 2.18.0 and 3.0.0-M4 was partly ineffective for Servers running on Windows.
Applications are affected if they use org.apache.sshd:sshd-git to implement a git server and run on Windows. Applications not using sshd-git or not running on Windows are not affected.
Users are advised to upgrade affected applications to Apache MINA SSHD 2.19.0, which fixes the issue.
The issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M4 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git and run on Windows. Upgrade affected applications to 3.0.0-M5.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | mina_sshd | — | — |
| apache | mina_sshd | — | — |
| apache | mina_sshd | — | — |
| apache | mina_sshd | — | — |
| apache | mina_sshd | >= 2.0.0 < 2.19.0 | 2.19.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Path traversal on Windows in Apache MINA SSHD component sshd-git.
ghsa_unreviewed·2026-07-20·CVSS 7.1
CVE-2026-56623 [HIGH] CWE-22 Path traversal on Windows in Apache MINA SSHD component sshd-git.
Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH.
A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories outside of the configured server-side root directory. The path validation applied for CVE-2026-48827 in Apache MINA SSHD 2.18.0 and 3.0.0-M4 was partly ineffective for Servers running on Windows.
Applications are affected if they use org.apache.sshd:sshd-git to implement a git server and run on Windows. Applications not using sshd-git or not running on Windows are not affected.
Users are advised to upgrade affected applications to Apache MINA SSHD 2.19.0, which fixes the issue.
The issue also
VulDB
Apache MINA SSHD up to 2.18.0/3.0.0-M4 sshd-git path traversal
vuldb·2026-07-20·CVSS 7.1
CVE-2026-56623 [HIGH] Apache MINA SSHD up to 2.18.0/3.0.0-M4 sshd-git path traversal
A vulnerability was found in Apache MINA SSHD up to 2.18.0/3.0.0-M4. It has been classified as critical. This impacts an unknown function of the component sshd-git. Performing a manipulation results in path traversal.
This vulnerability was named CVE-2026-56623. The attack may be initiated remotely. There is no available exploit.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-20
Published