PT-2026-61721 · Apache · Apache Mina Sshd

Unbbal · CVE-2026-58624 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Apache MINA SSHD versions prior to 2.19.0 Apache MINA SSHD versions prior to 3.0.0-M5

Description Improper input validation in the sshd-git component of Apache MINA SSHD, specifically within the GitPgmCommandFactory, allows an authenticated SSH user to execute arbitrary JGit commands. This can lead to unauthorized file writes at arbitrary locations on the server, for example, by using the git archive command with the --output option.

Recommendations Upgrade to version 2.19.0. Upgrade to version 3.0.0-M5. As a temporary mitigation, avoid configuring the GitPgmCommandFactory on the server.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-58624

Affected Products

Apache Mina Sshd

References · 4

• https://lists.apache.org/thread/7c3cry6pdy6hj1q0f28rc72x4o4tlyjo · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-58624 · Security Note
• http://openwall.com/lists/oss-security/2026/07/20/18 · Note
• https://twitter.com/vulnipulse/status/2079309506920722580 · Twitter Post