Read the docs
TI-2026-63254 Aliases CVE-2026-93995GHSA-9jwj-xh8m-f4vf

Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the server

Priority LOW 28CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that authenticated SSH clients can remotely execute git commands via the JGit library on git repositories stored on the server. In CVE-2026-58624 this mechanism was restricted to only a few git commands, including "git archive" without "--output" or "-o" options such that the resulting archive would not be written on the server but instead sent back to the client over the SSH connection. The fix done for CVE-2026-58624 was insufficient as it missed removing the single-argument "-o=file.zip" version of the command parameter from the "archive" command. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00231 13th percentileScored 2026-11-07
Fix Fixed Apache MINA SSHD (Apache Software Foundation): 2.20.0, 3.0.0-M6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache MINA SSHDbefore 2.20.0; 3.0.0-M1 to before 3.0.0-M62.20.0, 3.0.0-M6Patch availableCNA
  • Apache MINA SSHD VendorApache Affected before 2.20.0; 3.0.0-M1 to before 3.0.0-M6 Fixed in 2.20.0, 3.0.0-M6 Patch available CNA

Remediation

  • Fix · CNA Apache MINA SSHD (Apache Software Foundation) Fixed in 2.20.0, 3.0.0-M6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache MINA SSHD 2.20.0, 3.0.0-M6

    8 records Highest priority Priority MEDIUM 3 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2026-63290 Apache MINA SSHD: LDAP injection in sshd-ldapPriority MEDIUM 47
    • TI-2026-63289 Apache MINA SSHD: LDAP password authentication ineffectivePriority MEDIUM 47
    • TI-2026-53907 Apache MINA SSHD: Asynchronous authentication can bypass signature verificationPriority MEDIUM 47
    Show all 8 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-93995
  2. 2026-10-03 Alias added: GHSA-9jwj-xh8m-f4vf

References

Advisory 1

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
See all 4053 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences