CVE-2026-56452 Details
Description
Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places. The issue affects only * applications that use no longer supported Apache MINA SSHD versions < 2.0.0 and use the SCP functions to receive files, * or applications using sshd-scp in Apache MINA SSHD >= 2.0.0 to receive files. Applications using Apache MINA SSHD >= 2.0.0 not using sshd-scp are not affected. The issue is fixed in Apache MINA 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to these versions.
A path traversal vulnerability has been identified in the sshd-scp component of Apache MINA SSHD, a Java library for SSH client and server applications. The issue arises in versions of Apache MINA SSHD prior to 2.0.0, as well as in versions 3.0.0-M1 through 3.0.0-M4. The vulnerability occurs because the SCP file reception implementation did not properly validate filenames in the SCP 'C' or 'D' commands. This oversight allows a malicious sender to include path information in filenames, potentially leading to files being written in locations controlled by the attacker.
Users are advised to upgrade to Apache MINA SSHD versions 2.19.0 or 3.0.0-M5.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/07/20/15 | CVE | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/xgoqvmksmd94fsqnzqjdtfjxf35os9no | [email protected] | Vendor AdvisoryMailing List |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache mina sshd | >= 2.0.0, < 2.19.0 3.0.0 m1 3.0.0 m2 3.0.0 m3 3.0.0 m4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 27, 2026 | Initial Analysis | [email protected] |
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | CVE Modified | CVE |
| Jul 20, 2026 | New CVE Received | [email protected] |