CVE-2026-56623Disclosure(apache / mina_sshd)

LOWCVSS 7.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch apache mina_sshd systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories outside of the configured server-side root directory. The path validation applied for CVE-2026-48827 in Apache MINA SSHD 2.18.0 and 3.0.0-M4 was partly ineffective for Servers running on Windows. Applications are affected if they use org.apache.sshd:sshd-git to implement a git server and run on Windows. Applications not using sshd-git or not running on Windows are not affected. Users are advised to upgrade affected applications to Apache MINA SSHD 2.19.0, which fixes the issue. The issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M4 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git and run on Windows. Upgrade affected applications to 3.0.0-M5.

apache CVEs Back to dashboard

1.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://lists.apache.org/thread/bhw26snzgvk0mtqqp5dcyjvczp4kcqky

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

mina_sshd
windows

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 2 classified signals
Peaked 1d ago at 3 mentions (2026-07-20); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

apache microsoft

Products

mina_sshdwindows

2 versions affected across 2 products

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

250.0%

Patch

250.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-20	3	Disclosure2Patch1
2026-07-22	1	Patch1

Full discourse4 posts

Open Source Security mailing list@oss_security90d
Patch
Apache MINA SSHD: 4 CVEs fixed https://www.openwall.com/lists/oss-security/2026/07/20/ 3 are "Severity: moderate": CVE-2026-56452: Path traversal in SCP file reception CVE-2026-56623: Path traversal in org.apache.sshd:sshd-git on Windows CVE-2026-56624: SSH certificate options lack validations 1 more is "low"
Post summary
Apache MINA SSHD has released patches for four CVEs, three of moderate severity involving path traversal and certificate validation flaws, and one low severity issue.
00091966
4.7K followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-56623 Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented… https://www.cve.org/CVERecord?id=CVE-2026-56623 ----- Traducción: CVE-2026-56623 Acceso… http://infoflow.cloud`
Post summary
The message announces a new CVE (CVE‑2026‑56623) that involves path traversal in Apache MINA SSHD, provides a link to the CVE record, but does not supply a PoC, exploit code, or evidence of active exploitation.
0000043
93 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-56623 Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented… https://www.cve.org/CVERecord?id=CVE-2026-56623
Post summary
The text announces CVE-2026-56623 as a path traversal issue on Windows within the Apache MINA SSHD component, providing a link to the official CVE record.
00000664
57.8K followersView on X
VulniPulse@vulnipulse91d
Patch
⚠️ Apache MINA SSHD alert: CVE-2026-48827 (CVSS 7.1) Attackers could access files outside the intended path. Apply the vendor-recommended mitigation. https://vulnipulse.com/advisories/apache-cve-2026-56623 #Apache #ApacheMINASSHD #CyberSecurity #CVE
Post summary
Apache MINA SSHD CVE‑2026‑48827, CVSS 7.1, allows attackers to read arbitrary files; vendors advise applying their recommended mitigation.
0000034
6 followersView on X

CPE platform detail6 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

6 of 6 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	mina_sshd	-	-	-
App	apache	mina_sshd	3.0.0	-	-
App	apache	mina_sshd	3.0.0	-	-
App	apache	mina_sshd	3.0.0	-	-
App	apache	mina_sshd	3.0.0	-	-
OS	microsoft	windows	-	-	-

Explore more

Back to dashboard apache CVEs microsoft CVEs mina_sshd vulnerabilities

What researchers are saying

CVE-2026-56623

VulniPulse[verified]@vulnipulsePatch

Apache MINA SSHD CVE‑2026‑48827, CVSS 7.1, allows attackers to read arbitrary files; vendors advise applying their recommended mitigation.

Open Source Security mailing list@oss_securityPatch

Apache MINA SSHD has released patches for four CVEs, three of moderate severity involving path traversal and certificate validation flaws, and one low severity issue.

Infoflowcloud@infoflowcloudDisclosure

The message announces a new CVE (CVE‑2026‑56623) that involves path traversal in Apache MINA SSHD, provides a link to the CVE record, but does not supply a PoC, exploit code, or evidence of active exploitation.

CVE@CVEnewDisclosure

The text announces CVE-2026-56623 as a path traversal issue on Windows within the Apache MINA SSHD component, providing a link to the official CVE record.