PT-2026-45380 · Apache · Apache Mina Sshd

J0Hndo · CVE-2026-48827 · Published 2026-06-01 · Updated 2026-07-27

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache MINA SSHD versions prior to 2.18.0 Apache MINA SSHD versions 3.0.0-M1 through 3.0.0-M3

Description A path traversal issue exists in the org.apache.sshd:sshd-git bundle. Due to insufficient path validation in git-upload-pack, git-receive-pack, and other git operations, users authenticated via SSH can access git repositories located outside the configured git server root directory. Path traversal is a vulnerability that allows an attacker to access files or directories that are stored outside the web root folder by manipulating variables such as file paths.

Recommendations Upgrade to Apache MINA SSHD version 2.18.0. Upgrade to Apache MINA SSHD version 3.0.0-M4. Implement additional security controls to govern access to git repositories and allowed operations instead of relying solely on file system layout and permissions.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-48827

GHSA-MW4M-QHPG-J82M

OPENSUSE-SU-2026:10919-1

SUSE-SU-2026:2472-1

Affected Products

Apache Mina Sshd

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48827.json · Exploit
• https://ubuntu.com/security/CVE-2026-48827 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-48827 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48827 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:2472-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-48827 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-48827 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-48827 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10919-1 · Vendor Advisory
• https://lists.apache.org/thread/910kq9ghm6js0k1yhhbrdm9sf5tqq9c9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-48827 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mw4m-qhpg-j82m · Vendor Advisory
• https://github.com/apache/mina-sshd · Note
• https://twitter.com/oss_security/status/2061618334139879861 · Twitter Post
• https://repo.maven.apache.org/maven2 · Note