CVE-2026-56452

Received Received - Intake

Path Traversal in Apache MINA SSHD SCP Component

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: Apache Software Foundation

Description

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places. The issue affects only * applications that use no longer supported Apache MINA SSHD versions < 2.0.0 and use the SCP functions to receive files, * or applications using sshd-scp in Apache MINA SSHD >= 2.0.0 to receive files. Applications using Apache MINA SSHD >= 2.0.0 not using sshd-scp are not affected. The issue is fixed in Apache MINA 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to these versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-56452

Affected Vendors & Products

Vendor	Product	Version / Range
apache	mina	From 2.0.0 (exc)
apache	mina	From 2.0.0 (inc)
apache	mina	sshd

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

This is a path traversal vulnerability in Apache MINA SSHD's sshd-scp component. It occurs when receiving files via SCP. The implementation fails to validate filenames in SCP 'C' or 'D' commands, allowing attackers to send filenames with paths. This can lead to files being written in unintended, attacker-controlled locations.

Detection Guidance

To detect this vulnerability, check if your system is running an affected version of Apache MINA SSHD (< 2.0.0 or >= 2.0.0 using sshd-scp). Verify the installed version with commands like 'find / -name "sshd-scp*" 2>/dev/null' or check application logs for SCP file transfers. Ensure no unauthorized file writes occur in unexpected directories.

Impact Analysis

An attacker could overwrite critical files, plant malicious code, or disrupt services by writing files to unauthorized directories. This could lead to system compromise, data corruption, or denial of service if the affected application has write permissions in sensitive locations.

Compliance Impact

This vulnerability could potentially violate compliance with standards like GDPR and HIPAA by allowing unauthorized file writes to attacker-controlled locations. If exploited, it may lead to unauthorized data access or modification, compromising data integrity and confidentiality.

Mitigation Strategies

Upgrade Apache MINA SSHD to version 2.19.0 or 3.0.0-M5. If using versions below 2.0.0, upgrade to a supported version immediately. Disable SCP file receiving functions if not required.

Hi! I’m here to help you understand CVE-2026-56452. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70