SB20260824171 - Multiple vulnerabilities in Apache Mina SSHD

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260824171

SB20260824171 - Multiple vulnerabilities in Apache Mina SSHD

Published: August 24, 2026

Security Bulletin ID SB20260824171
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Input validation error (CVE-ID: CVE-2026-58624)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to write files on the server.

The vulnerability exists due to improper input validation in GitPgmCommandFactory in sshd-git when executing JGit commands over SSH. A remote user can invoke a JGit command with crafted arguments to write files on the server.

Only SSH servers using the GitPgmCommandFactory are vulnerable.


2) Improper Certificate Validation (CVE-ID: CVE-2026-56624)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute commands outside intended certificate restrictions.

The vulnerability exists due to improper certificate validation in server-side OpenSSH user certificate validation when processing certificate options during user authentication. A remote user can present a crafted certificate containing an unsupported force-command or verify-required option to execute commands outside intended certificate restrictions.

The specific commands available depend on the implementation of the server.


3) Path traversal (CVE-ID: CVE-2026-56623)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to access git repositories outside of the configured server-side root directory.

The vulnerability exists due to path traversal in org.apache.sshd:sshd-git when handling repository path access on Windows. A remote user can supply crafted repository paths to access git repositories outside of the configured server-side root directory.

Only applications that use sshd-git to implement a git server and run on Windows are vulnerable.


4) Path traversal (CVE-ID: CVE-2026-56452)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to write files to unintended locations.

The vulnerability exists due to path traversal in the sshd-scp component when receiving files or directories via SCP. A remote user can send specially crafted SCP "C" or "D" commands with filenames containing paths to write files to unintended locations.

Only applications using the SCP receive functionality are affected.


Remediation

Install update from vendor's website.

References