VulnSocial

CVE-2026-56452Disclosure(apache / mina_sshd)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch apache mina_sshd systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places. The issue affects only * applications that use no longer supported Apache MINA SSHD versions < 2.0.0 and use the SCP functions to receive files, * or applications using sshd-scp in Apache MINA SSHD >= 2.0.0 to receive files. Applications using Apache MINA SSHD >= 2.0.0 not using sshd-scp are not affected. The issue is fixed in Apache MINA 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to these versions.

apache CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-22CWE-73

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • mina_sshd

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 3 mentions (2026-07-20); latest day: 1
  • 4 total mentions across 2 days

Affected systems

Vendors
apache
Products
mina_sshd

1 version affected across 1 product

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-07-20: 3Mentions · 2026-07-22: 1Patch / Workaround · 2026-07-20: 1Patch / Workaround · 2026-07-22: 1Technical Details · 2026-07-20: 3Technical Details · 2026-07-22: 107-2007-22
Signal classification2 categories
Disclosure
250.0%
Patch
250.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-07-203
Disclosure2Patch1
2026-07-221
Patch1
Full discourse4 posts
  • Open Source Security mailing list@oss_security
    Patch

    Apache MINA SSHD: 4 CVEs fixed https://www.openwall.com/lists/oss-security/2026/07/20/ 3 are "Severity: moderate": CVE-2026-56452: Path traversal in SCP file reception CVE-2026-56623: Path traversal in org.apache.sshd:sshd-git on Windows CVE-2026-56624: SSH certificate options lack validations 1 more is "low"

    Post summary

    Four Apache MINA SSHD CVEs were fixed—three with moderate severity and one with low—demonstrating that updates address path traversal and certificate validation flaws.

    00091966
    4.7K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-56452 Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiv… https://www.cve.org/CVERecord?id=CVE-2026-56452 ----- Traducción: CVE-2026-56452 Pase d… http://infoflow.cloud`

    Post summary

    The text announces CVE-2026-56452 as a path‑traversal flaw in Apache MINA SSHD’s sshd‑scp component, providing only basic vulnerability details and no evidence of exploitation or remediation.

    0000049
    93 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-56452 Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiv… https://www.cve.org/CVERecord?id=CVE-2026-56452

    Post summary

    The brief entry announces a path traversal flaw (CVE-2026-56452) in Apache MINA SSHD's sshd‑scp component, offering no evidence of exploitation, PoC, patch, or debunking.

    00000749
    57.8K followersView on X
  • VulniPulse@vulnipulse
    Patch

    ⚠️ Apache MINA SSHD alert: CVE-2026-56452 (CVSS 7.5) Attackers could access files outside the intended path. Upgrade to a vendor-listed fixed release. https://vulnipulse.com/advisories/apache-cve-2026-56452 #Apache #ApacheMINASSHD #CyberSecurity #CVE

    Post summary

    The advisory announces CVE-2026-56452, a path‑traversal weakness in Apache MINA SSHD with a CVSS 7.5 score, and urges users to upgrade to a vendor‑fixed release; no PoC, exploit code, or active exploitation is reported.

    0000037
    6 followersView on X
CPE platform detail5 entries

5 of 5 entries

PartVendorProductVersionTarget SWTarget HW
Appapachemina_sshd---
Appapachemina_sshd3.0.0--
Appapachemina_sshd3.0.0--
Appapachemina_sshd3.0.0--
Appapachemina_sshd3.0.0--

Explore more

Back to dashboardapache CVEsmina_sshd vulnerabilities