Path Traversal Vulnerability in Apache MINA SSHD Git Component on Windows

CVE-2026-56623

What is CVE-2026-56623?

A path traversal vulnerability has been identified in the Apache MINA SSHD component, specifically in the sshd-git implementation when running on Windows. This flaw allows authenticated remote users to access git repositories located outside the designated server-side root directory. Previous path validation measures taken in versions 2.18.0 and 3.0.0-M4 were ineffective on Windows. Applications relying on org.apache.sshd:sshd-git on this platform are at risk. Users should upgrade their applications to Apache MINA SSHD version 2.19.0 or 3.0.0-M5 to mitigate this vulnerability.

References