CVE-2026-56623

Received Received - Intake

Path Traversal in Apache MINA SSHD sshd-git on Windows

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: Apache Software Foundation

Description

Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories outside of the configured server-side root directory. The path validation applied for CVE-2026-48827 in Apache MINA SSHD 2.18.0 and 3.0.0-M4 was partly ineffective for Servers running on Windows. Applications are affected if they use org.apache.sshd:sshd-git to implement a git server and run on Windows. Applications not using sshd-git or not running on Windows are not affected. Users are advised to upgrade affected applications to Apache MINA SSHD 2.19.0, which fixes the issue. The issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M4 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git and run on Windows. Upgrade affected applications to 3.0.0-M5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-56623

Affected Vendors & Products

Vendor	Product	Version / Range
apache	mina	sshd
apache	mina	From 3.0.0-M1 (inc) to 3.0.0-M4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This is a path traversal vulnerability in Apache MINA SSHD's sshd-git component on Windows. An authenticated remote user could access git repositories outside the server's configured root directory due to ineffective path validation.

Detection Guidance

Detection involves checking if your system runs Apache MINA SSHD sshd-git on Windows and is vulnerable. Verify the version of Apache MINA SSHD in use. If using sshd-git and version is below 2.19.0 or 3.0.0-M5, the system is likely vulnerable.

Impact Analysis

If you run a git server using Apache MINA SSHD's sshd-git on Windows, an attacker could access sensitive repositories outside the intended directory. This could lead to unauthorized data exposure or manipulation.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data, potentially breaching GDPR or HIPAA if protected repositories are exposed.

Mitigation Strategies

Upgrade Apache MINA SSHD to version 2.19.0 or 3.0.0-M5 or later. Ensure the application uses sshd-git and runs on Windows before applying the fix. Remove or restrict access if upgrading is not immediately possible.

Hi! I’m here to help you understand CVE-2026-56623. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70