Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory. Applications are affected if they use org.apache.sshd:sshd-git. Applications not using sshd-git are not affected. Users are advised to upgrade affected applications to Apche MINA SSHD 2.18.0, which fixes the issue. The issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M3 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git. Upgrade affected applications to 3.0.0-M4. We would like to point out that a professional git server should not rely solely on file system layout and permissions, but should implement additional security controls to govern access to git repositories and operations allowed on particular git repositories.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache MINA SSHD | 2.0.0 – 2.17.1; 3.0.0-M1 – 3.0.0-M3 | — | No fix listed | CNA |
| — | org.apache.sshd:sshd-git (Maven) | before 2.18.0 | 2.18.0 | Patch available | GHSA-mw4m-qhpg-j82m |
| — | org.apache.sshd:sshd-git (Maven) | 3.0.0-M1 to before 3.0.0-M4 | 3.0.0-M4 | Patch available | GHSA-mw4m-qhpg-j82m |
- Apache MINA SSHD VendorApache Affected 2.0.0 – 2.17.1; 3.0.0-M1 – 3.0.0-M3 Fixed in — No fix listed CNA
- org.apache.sshd:sshd-git (Maven) Vendor— Affected before 2.18.0 Fixed in 2.18.0 Patch available GHSA-mw4m-qhpg-j82m
- org.apache.sshd:sshd-git (Maven) Vendor— Affected 3.0.0-M1 to before 3.0.0-M4 Fixed in 3.0.0-M4 Patch available GHSA-mw4m-qhpg-j82m
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:mina_sshd:*:*:*:*:*:*:*:* | 2.0.0 to before 2.18.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:mina_sshd:3.0.0:m1:*:*:*:*:*:* | 3.0.0 m1 | Vulnerable | Apache |
| cpe:2.3:a:apache:mina_sshd:3.0.0:m2:*:*:*:*:*:* | 3.0.0 m2 | Vulnerable | Apache |
| cpe:2.3:a:apache:mina_sshd:3.0.0:m3:*:*:*:*:*:* | 3.0.0 m3 | Vulnerable | Apache |
- cpe:2.3:a:apache:mina_sshd:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.18.0 Vulnerable ·Apache
- cpe:2.3:a:apache:mina_sshd:3.0.0:m1:*:*:*:*:*:* Versions 3.0.0 m1 Vulnerable ·Apache
- cpe:2.3:a:apache:mina_sshd:3.0.0:m2:*:*:*:*:*:* Versions 3.0.0 m2 Vulnerable ·Apache
- cpe:2.3:a:apache:mina_sshd:3.0.0:m3:*:*:*:*:*:* Versions 3.0.0 m3 Vulnerable ·Apache
Remediation
- Fix · GHSA-mw4m-qhpg-j82m org.apache.sshd:sshd-git (Maven) Fixed in 2.18.0 Advisory →
- Fix · GHSA-mw4m-qhpg-j82m org.apache.sshd:sshd-git (Maven) Fixed in 3.0.0-M4 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-48827
- 2026-10-03 Alias added: GHSA-mw4m-qhpg-j82m
- 2026-10-25 EPSS moved to the below the 50th percentile
References
More Apache Mina Sshd vulnerabilities
- TI-2019-04327 An issue was discovered in OpenSSH 7.9. CVSS 3.1MEDIUM 5.9
- TI-2026-40791 Apache MINA SSHD: Path traversal in SCP file reception CVSS 3.1HIGH 7.5
- TI-2026-40830 Apache MINA SSHD: SSH certificate options lack validations CVSS 3.1HIGH 7.3
- TI-2026-40829 Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows CVSS 3.1HIGH 7.1
- TI-2024-27935 Apache MINA SSHD: integrity check bypass CVSS 3.1MEDIUM 5.9
- TI-2026-42194 Apache MINA SSHD: Remote execution of JGit commands can write files on the server CVSS 3.1MEDIUM 5.4
Sources
- CVE-2026-48827 · CVE Program
- CVE-2026-48827 · NVD
- FIRST EPSS
- GHSA-mw4m-qhpg-j82m · GitHub Advisory Database · CC BY 4.0
- CVE-2026-48827 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences