TI-2026-40791 Aliases CVE-2026-56452 GHSA-2vf2-jm4x-2gj4

Apache MINA SSHD: Path traversal in SCP file reception

MEDIUM 40CWE-22Published 2026-07-20 · Updated 2026-07-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places. The issue affects only * applications that use no longer supported Apache MINA SSHD versions < 2.0.0 and use the SCP functions to receive files, * or applications using sshd-scp in Apache MINA SSHD >= 2.0.0 to receive files. Applications using Apache MINA SSHD >= 2.0.0 not using sshd-scp are not affected. The issue is fixed in Apache MINA 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to these versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00772 55th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache MINA SSHD	up to 2.18.0; 3.0.0-M1 – 3.0.0-M4	—	No fix listed	CNA

Apache MINA SSHD VendorApache Affected up to 2.18.0; 3.0.0-M1 – 3.0.0-M4 Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:mina_sshd::::::::	2.0.0 to before 2.19.0	Vulnerable	Apache
cpe:2.3:a:apache:mina_sshd:3.0.0:m1::::::	3.0.0 m1	Vulnerable	Apache
cpe:2.3:a:apache:mina_sshd:3.0.0:m2::::::	3.0.0 m2	Vulnerable	Apache
cpe:2.3:a:apache:mina_sshd:3.0.0:m3::::::	3.0.0 m3	Vulnerable	Apache
cpe:2.3:a:apache:mina_sshd:3.0.0:m4::::::	3.0.0 m4	Vulnerable	Apache

cpe:2.3:a:apache:mina_sshd:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.19.0 Vulnerable ·Apache
cpe:2.3:a:apache:mina_sshd:3.0.0:m1:*:*:*:*:*:* Versions 3.0.0 m1 Vulnerable ·Apache
cpe:2.3:a:apache:mina_sshd:3.0.0:m2:*:*:*:*:*:* Versions 3.0.0 m2 Vulnerable ·Apache
cpe:2.3:a:apache:mina_sshd:3.0.0:m3:*:*:*:*:*:* Versions 3.0.0 m3 Vulnerable ·Apache
cpe:2.3:a:apache:mina_sshd:3.0.0:m4:*:*:*:*:*:* Versions 3.0.0 m4 Vulnerable ·Apache

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-56452
2026-10-03 Alias added: GHSA-2vf2-jm4x-2gj4

References

Advisory 2

TI-2019-04327 An issue was discovered in OpenSSH 7.9. CVSS 3.1MEDIUM 5.9
TI-2026-40830 Apache MINA SSHD: SSH certificate options lack validations CVSS 3.1HIGH 7.3
TI-2026-40829 Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows CVSS 3.1HIGH 7.1
TI-2026-36095 Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git CVSS 3.1HIGH 7.1
TI-2024-27935 Apache MINA SSHD: integrity check bypass CVSS 3.1MEDIUM 5.9
TI-2026-42194 Apache MINA SSHD: Remote execution of JGit commands can write files on the server CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences