Skip to content
fr Sign in
7.5 High

CVE-2026-56452 Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and…

Description

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places. The issue affects only * applications that use no longer supported Apache MINA SSHD versions < 2.0.0 and use the SCP functions to receive files, * or applications using sshd-scp in Apache MINA SSHD >= 2.0.0 to receive files. Applications using Apache MINA SSHD >= 2.0.0 not using sshd-scp are not affected. The issue is fixed in Apache MINA 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to these versions.

Affected products and versions

Product Affected versions Fixed in
Apache Mina SSHD 3.0 3.0.0-M1 → 3.0.0-M4 No fix stated
Apache Mina SSHD 2.18 earliest → 2.18.0 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Mina SSHD

The 17 CVEs of Apache Mina SSHD →
CVE-2026-77185 Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain… 9.1 Critical CVE-2026-93994 Apache MINA SSHD is a Java library for client-side and server-side SSH 8.1 High CVE-2026-94053 Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and… 9.1 Critical CVE-2026-93995 Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 6.5 Medium
Track this CVE