Riskcovery

CVE-2026-56452

Apache MINA SSHD: Path traversal in SCP file reception

State
Published
Severity
7.5 High
Published
Jul 20, 2026
Updated
Jul 21, 2026
Reserved
Jun 22, 2026

Read the record on cve.org

Description

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH.

The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places.

The issue affects only

* applications that use no longer supported Apache MINA SSHD versions < 2.0.0 and use the SCP functions to receive files, * or applications using sshd-scp in Apache MINA SSHD >= 2.0.0 to receive files.

Applications using Apache MINA SSHD >= 2.0.0 not using sshd-scp are not affected.

The issue is fixed in Apache MINA 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to these versions.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Napache

Weaknesses

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-73 External Control of File Name or Path

Affected Products

ProductVersions
Apache MINA SSHDApache Software Foundation
  • 2.18.0 and earlierAffected
  • 3.0.0-M1 through 3.0.0-M4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.