CVE-2026-48827General(apache / mina_sshd)

LOWCVSS 7.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch apache mina_sshd systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory. Applications are affected if they use org.apache.sshd:sshd-git. Applications not using sshd-git are not affected. Users are advised to upgrade affected applications to Apche MINA SSHD 2.18.0, which fixes the issue. The issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M3 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git. Upgrade affected applications to 3.0.0-M4. We would like to point out that a professional git server should not rely solely on file system layout and permissions, but should implement additional security controls to govern access to git repositories and operations allowed on particular git repositories.

apache CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

mina_sshd

Threat summary

Patch or workaround signal is available
6 mentions across 6 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
General: 4 classified signals
Disclosure: 1 classified signal
Peaked 5d ago at 1 mentions (2026-05-30); latest day: 1
6 total mentions across 6 days

Affected systems

Vendors

apache

Products

mina_sshd

1 version affected across 1 product

Deep dive

Activity timeline6 mentions / 6d

Signal classification3 categories

General

466.7%

Disclosure

116.7%

Patch

116.7%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-30	1	General1
2026-06-02	1	Disclosure1
2026-06-19	1	General1
2026-06-20	1	General1
2026-06-21	1	General1
2026-07-20	1	Patch1

Full discourse6 posts

Open Source Security mailing list@oss_security134d
Disclosure
CVE-2026-48827: Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git https://www.openwall.com/lists/oss-security/2026/05/30/1 in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory
Post summary
The post announces a new path traversal vulnerability in Apache MINA SSHD’s git components that allows authenticated users to reach files outside the configured repository root.
00020494
4.7K followersView on X
VulniPulse@vulnipulse85d
Patch
⚠️ Apache MINA SSHD alert: CVE-2026-48827 (CVSS 7.1) Attackers could access files outside the intended path. Apply the vendor-recommended mitigation. https://vulnipulse.com/advisories/apache-cve-2026-56623 #Apache #ApacheMINASSHD #CyberSecurity #CVE
Post summary
The advisory announces CVE‑2026‑48827 in Apache MINA SSHD, describing a path traversal flaw (CVSS 7.1) and urges users to apply the vendor‑recommended mitigation. No PoC or exploitation details are provided.
0000034
6 followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker115d
General
CVE-2026-48827 org.apache.sshd:sshd-gitを使用するアプリケーションの脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/06/14/cve-2026-48827-orgapachesshdsshd-git/ #IT #Security #cybersecurity
Post summary
The text points to a blog post that explains CVE‑2026‑48827 for org.apache.sshd:sshd‑git, summarizing its impact and countermeasures, but it contains no explicit details on PoC, exploit code, active exploitation, patches, or technical specifics.
0000045
208 followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker115d
General
CVE-2026-48827 org.apache.sshd:sshd-gitを使用するアプリケーションの脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/06/14/cve-2026-48827-orgapachesshdsshd-git/ #IT #Security #cybersecurity
Post summary
The tweet links to an article that explains CVE-2026-48827 for org.apache.sshd:sshd‑git, but it contains no specific information on exploitation, patches, or technical depth.
0000038
208 followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker117d
General
CVE-2026-48827 org.apache.sshd:sshd-gitを使用するアプリケーションの脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/06/14/cve-2026-48827-orgapachesshdsshd-git/ #IT #Security #cybersecurity
Post summary
A Japanese blog post headline indicates it will explain the CVE‑2026‑48827 vulnerability, scope, and countermeasures, but the text does not provide specific technical details, patches, or proof‑of‑concept information.
0000052
209 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds137d
General
CVE-2026-48827 CVE-2026-48827 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48827
Post summary
The post merely lists CVE‑2026‑48827 twice and links to a general vulnerability details page, offering no further information on exploitation, patching, or technical specifics.
0000040
4.0K followersView on X

CPE platform detail4 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

4 of 4 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	mina_sshd	-	-	-
App	apache	mina_sshd	3.0.0	-	-
App	apache	mina_sshd	3.0.0	-	-
App	apache	mina_sshd	3.0.0	-	-

Explore more

Back to dashboard apache CVEs mina_sshd vulnerabilities

What researchers are saying

CVE-2026-48827

VulniPulse[verified]@vulnipulsePatch

The advisory announces CVE‑2026‑48827 in Apache MINA SSHD, describing a path traversal flaw (CVSS 7.1) and urges users to apply the vendor‑recommended mitigation. No PoC or exploitation details are provided.

Open Source Security mailing list@oss_securityDisclosure

The post announces a new path traversal vulnerability in Apache MINA SSHD’s git components that allows authenticated users to reach files outside the configured repository root.

ケイ | IT・セキュリティ系副業Webライター@Teeeda_workerGeneral

The text points to a blog post that explains CVE‑2026‑48827 for org.apache.sshd:sshd‑git, summarizing its impact and countermeasures, but it contains no explicit details on PoC, exploit code, active exploitation, patches, or technical specifics.

ケイ | IT・セキュリティ系副業Webライター@Teeeda_workerGeneral

The tweet links to an article that explains CVE-2026-48827 for org.apache.sshd:sshd‑git, but it contains no specific information on exploitation, patches, or technical depth.

ケイ | IT・セキュリティ系副業Webライター@Teeeda_workerGeneral

A Japanese blog post headline indicates it will explain the CVE‑2026‑48827 vulnerability, scope, and countermeasures, but the text does not provide specific technical details, patches, or proof‑of‑concept information.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The post merely lists CVE‑2026‑48827 twice and links to a general vulnerability details page, offering no further information on exploitation, patching, or technical specifics.