CVE-2026-56623: Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows

Q: What is the severity of CVE-2026-56623?

The severity of CVE-2026-56623 is high with a score of 7.1.

Q: How does CVE-2026-56623 affect Apache MINA SSHD?

CVE-2026-56623 allows an authenticated remote user to exploit path traversal vulnerabilities in Apache MINA SSHD on Windows.

Q: What attack vectors are associated with CVE-2026-56623?

CVE-2026-56623 is associated with vulnerabilities classified as AV:N (Network), AC:L (Low), PR:L (Low), UI:N (None), S:U (User), C:H (High), I:L (Low), A:N (None).

Q: How do I mitigate CVE-2026-56623 in my application?

To mitigate CVE-2026-56623, ensure you are using the latest version of the Apache MINA SSHD sshd-git component and implement proper input validation.

Q: Who is affected by CVE-2026-56623?

CVE-2026-56623 affects users and systems running Apache MINA SSHD sshd-git on Windows that have misconfigured path access to git repositories.

Published Jul 20, 2026

Updated

Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH.

A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories outside of the configured server-side root directory. The path validation applied for CVE-2026-48827 in Apache MINA SSHD 2.18.0 and 3.0.0-M4 was partly ineffective for Servers running on Windows.

Applications are affected if they use org.apache.sshd:sshd-git to implement a git server and run on Windows. Applications not using sshd-git or not running on Windows are not affected.

Users are advised to upgrade affected applications to Apache MINA SSHD 2.19.0, which fixes the issue.

The issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M4 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git and run on Windows. Upgrade affected applications to 3.0.0-M5.

Affected Software

9 affected components

Apache MINA SSHD sshd-git>=2.18.0<=2.19.0

Apache MINA SSHD sshd-git>=3.0.0-M4<=3.0.0-M4

Apache MINA SSHD sshd-git>=3.0.0-M1<=3.0.0-M4

All of the following

Any of the following

Apache MINA SSHD>=2.0.0<2.19.0

Apache MINA SSHD=3.0.0-m1

Apache MINA SSHD=3.0.0-m2

Apache MINA SSHD=3.0.0-m3

Apache MINA SSHD=3.0.0-m4

Microsoft Windows

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache MINA SSHD (sshd-git) to a version that resolves this vulnerability.
Fixed in 3.0.0-M5
Upgrade
Upgrade Apache MINA SSHD (sshd-git) to a version that resolves this vulnerability.
Fixed in 2.19.0

Event History

Jul 20, 2026

CVE Published

via MITRE·08:29 PM

Data Sourced

via MITRE·08:29 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-56623?

The severity of CVE-2026-56623 is high with a score of 7.1.

How does CVE-2026-56623 affect Apache MINA SSHD?

CVE-2026-56623 allows an authenticated remote user to exploit path traversal vulnerabilities in Apache MINA SSHD on Windows.

What attack vectors are associated with CVE-2026-56623?

CVE-2026-56623 is associated with vulnerabilities classified as AV:N (Network), AC:L (Low), PR:L (Low), UI:N (None), S:U (User), C:H (High), I:L (Low), A:N (None).

How do I mitigate CVE-2026-56623 in my application?