CVE-2026-56452highCWE-22CWE-73

CVE-2026-56452: fallo de gravedad alta en Apache MINA SSHD

Apache MINA SSHD: Path traversal in SCP file reception

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Apache MINA SSHD+ Monitorear libmina-sshd-java

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.8%
Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places. The issue affects only * applications that use no longer supported Apache MINA SSHD versions < 2.0.0 and use the SCP functions to receive files, * or applications using sshd-scp in Apache MINA SSHD >= 2.0.0 to receive files. Applications using Apache MINA SSHD >= 2.0.0 not using sshd-scp are not affected. The issue is fixed in Apache MINA 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to these versions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Productos afectados
Apache Software Foundation · Apache MINA SSHD
CVEs relacionadas — Apache MINA SSHD

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-45047CRITICALApache MINA SSHD: Java unsafe deserialization vulnerabilityEPSS 3.8%CVE-2023-35887MEDIUMApache MINA SSHD: Information disclosure bugs with RootedFilesystemEPSS 1.3%CVE-2026-56623HIGHApache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on WindowsEPSS 0.9%CVE-2026-58624MEDIUMApache MINA SSHD: Remote execution of JGit commands can write files on the serverEPSS 0.6%CVE-2024-41909MEDIUMApache MINA SSHD: integrity check bypassEPSS 0.6%CVE-2026-48827HIGHApache MINA SSHD: Path traversal in org.apache.sshd:sshd-gitEPSS 0.5%