PT-2026-45380 · Apache · Apache Mina Sshd

J0Hndo · Published 2026-06-01 · Updated 2026-06-02 · CVE-2026-48827

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache MINA SSHD versions prior to 2.18.0 Apache MINA SSHD versions 3.0.0-M1 through 3.0.0-M3

Description A path traversal issue exists in the org.apache.sshd:sshd-git bundle. Due to a lack of path validation in git-upload-pack, git-receive-pack, and other git operations, users authenticated over SSH can access git repositories located outside the configured git server root directory. Path traversal is a security flaw that allows an attacker to read or write files on the server outside of the intended folder by using special characters like dot-dot-slash (../).

Recommendations Upgrade to version 2.18.0. Upgrade to version 3.0.0-M4. Implement additional security controls to govern access to git repositories and operations rather than relying solely on file system layout and permissions.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-48827

OPENSUSE-SU-2026:10919-1

Affected Products

Apache Mina Sshd

References · 14

• https://lists.apache.org/thread/910kq9ghm6js0k1yhhbrdm9sf5tqq9c9 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10919-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-48827 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-48827 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-48827 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48827 · Security Note
• https://ubuntu.com/security/CVE-2026-48827 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-48827 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-48827 · Note
• http://openwall.com/lists/oss-security/2026/05/30/1 · Note
• https://t.me/CVEtracker/55462 · Telegram Post
• https://suse.com/security/cve/CVE-2020-36843 · Note
• https://openwall.com/lists/oss-security/2026/05/30/1 · Note
• https://twitter.com/oss_security/status/2061618334139879861 · Twitter Post