CVE-2026-56623

Estado: AnalizadaAlta (7.1)—

Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH.

A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories outside of the configured server-side root directory. The path validation applied for CVE-2026-48827 in Apache MINA SSHD 2.18.0 and 3.0.0-M4 was partly ineffective for Servers running on Windows.

Applications are affected if they use org.apache.sshd:sshd-git to implement a git server and run on Windows. Applications not using sshd-git or not running on Windows are not affected.

Leer descripción completaMostrar menos

Users are advised to upgrade affected applications to Apache MINA SSHD 2.19.0, which fixes the issue.

The issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M4 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git and run on Windows. Upgrade affected applications to 3.0.0-M5.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Puntuación base: 7.1

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.87%
Percentil entre todas las CVEs puntuadas: 57
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement85 %
Impacto principalT1005 Data from Local Systemcollection90 %
Impacto secundarioT1565 Data Manipulationimpact60 %

AV:N/PR:L requiere red y privilegios; path traversal en Windows permite acceso no autorizado a repositorios fuera del directorio raíz configurado (lectura y potencial manipulación de datos).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Network Segmentation Vulnerability Scanning Threat Intelligence Program Restrict File and Directory Permissions Privileged Account Management Remote Data Storage

Tecnologías afectadas (1)

Apache — Mina Sshd

CWE

CWE-22

Referencias

https://lists.apache.org/thread/bhw26snzgvk0mtqqp5dcyjvczp4kcqky

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-56623",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-56623",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-21T17:07:35.150777Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@apache.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache MINA SSHD",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0",
              "versionType": "maven",
              "lessThanOrEqual": "2.18.0"
            },
            {
              "status": "affected",
              "version": "3.0.0-M1",
              "versionType": "maven",
              "lessThanOrEqual": "3.0.0-M4"
            }
          ],
          "packageName": "org.apache.sshd:sshd-git",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-07-20T21:16:48.947",
  "references": [
    {
      "url": "https://lists.apache.org/thread/bhw26snzgvk0mtqqp5dcyjvczp4kcqky",
      "tags": [
        "Vendor Advisory",
        "Mailing List"
      ],
      "source": "security@apache.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH.\n\n\n\n\nA git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories outside of the configured server-side root directory. The path validation applied for CVE-2026-48827 in Apache MINA SSHD 2.18.0 and 3.0.0-M4 was partly ineffective for Servers running on Windows.\n\n\n\n\nApplications are affected if they use org.apache.sshd:sshd-git to implement a git server and run on Windows. Applications not using sshd-git or not running on Windows are not affected.\n\n\n\n\nUsers are advised to upgrade affected applications to Apache MINA SSHD 2.19.0, which fixes the issue.\n\n\n\n\nThe issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M4 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git and run on Windows. Upgrade affected applications to 3.0.0-M5."
    }
  ],
  "lastModified": "2026-07-27T13:50:42.327",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:mina_sshd:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "93103A71-FB42-4C50-8529-232D40EAD7DD",
              "versionEndExcluding": "2.19.0",
              "versionStartIncluding": "2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:mina_sshd:3.0.0:m1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "32435A6F-3BD6-4AAB-93B1-0B1514419A50"
            },
            {
              "criteria": "cpe:2.3:a:apache:mina_sshd:3.0.0:m2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E399FD6-9A33-4F78-AFCE-F46C7BBC56F1"
            },
            {
              "criteria": "cpe:2.3:a:apache:mina_sshd:3.0.0:m3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13419EBE-E6B4-4895-BF6C-FC910076CC7A"
            },
            {
              "criteria": "cpe:2.3:a:apache:mina_sshd:3.0.0:m4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B2D4A4D-BEF5-416F-91AD-B4F278B04C76"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@apache.org"
}