CVE-2026-48827

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48827", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-05-23T09:06:08.581Z", "datePublished": "2026-06-01T08:37:41.968Z", "dateUpdated": "2026-06-01T12:44:56.455Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.sshd:sshd-git", "product": "Apache MINA SSHD", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.17.1", "status": "affected", "version": "2.0.0", "versionType": "maven"}, {"lessThanOrEqual": "3.0.0-M3", "status": "affected", "version": "3.0.0-M1", "versionType": "maven"}]}], "credits": [{"lang": "en", "type": "finder", "value": "j0hndo (dohyun4466@gmail.com)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory.</div><div><br></div><div>Applications are affected if they use org.apache.sshd:sshd-git. Applications not using sshd-git are not affected.</div><div><br></div><div>Users are advised to upgrade affected applications to Apche MINA SSHD 2.18.0, which fixes the issue.</div><div><br></div><div>The issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M3 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git. Upgrade affected applications to 3.0.0-M4.</div><div><br></div><div>We would like to point out that a professional git server should not rely solely on file system layout and permissions, but should implement additional security controls to govern access to git repositories and operations allowed on particular git repositories.</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div>"}], "value": "Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory.\n\n\n\n\nApplications are affected if they use org.apache.sshd:sshd-git. Applications not using sshd-git are not affected.\n\n\n\n\nUsers are advised to upgrade affected applications to Apche MINA SSHD 2.18.0, which fixes the issue.\n\n\n\n\nThe issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M3 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git. Upgrade affected applications to 3.0.0-M4.\n\n\n\n\nWe would like to point out that a professional git server should not rely solely on file system layout and permissions, but should implement additional security controls to govern access to git repositories and operations allowed on particular git repositories."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-06-01T08:37:41.968Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/910kq9ghm6js0k1yhhbrdm9sf5tqq9c9"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/05/30/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-06-01T09:52:50.126Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-01T12:44:52.544626Z", "id": "CVE-2026-48827", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-01T12:44:56.455Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/05/30/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-06-01T09:52:50.126Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-48827", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T12:44:52.544626Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-01T12:44:47.788Z"}}], "cna": {"title": "Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "j0hndo (dohyun4466@gmail.com)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache MINA SSHD", "versions": [{"status": "affected", "version": "2.0.0", "versionType": "maven", "lessThanOrEqual": "2.17.1"}, {"status": "affected", "version": "3.0.0-M1", "versionType": "maven", "lessThanOrEqual": "3.0.0-M3"}], "packageName": "org.apache.sshd:sshd-git", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/910kq9ghm6js0k1yhhbrdm9sf5tqq9c9", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory.\n\n\n\n\nApplications are affected if they use org.apache.sshd:sshd-git. Applications not using sshd-git are not affected.\n\n\n\n\nUsers are advised to upgrade affected applications to Apche MINA SSHD 2.18.0, which fixes the issue.\n\n\n\n\nThe issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M3 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git. Upgrade affected applications to 3.0.0-M4.\n\n\n\n\nWe would like to point out that a professional git server should not rely solely on file system layout and permissions, but should implement additional security controls to govern access to git repositories and operations allowed on particular git repositories.", "supportingMedia": [{"type": "text/html", "value": "<div>Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory.</div><div><br></div><div>Applications are affected if they use org.apache.sshd:sshd-git. Applications not using sshd-git are not affected.</div><div><br></div><div>Users are advised to upgrade affected applications to Apche MINA SSHD 2.18.0, which fixes the issue.</div><div><br></div><div>The issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M3 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git. Upgrade affected applications to 3.0.0-M4.</div><div><br></div><div>We would like to point out that a professional git server should not rely solely on file system layout and permissions, but should implement additional security controls to govern access to git repositories and operations allowed on particular git repositories.</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-06-01T08:37:41.968Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48827", "state": "PUBLISHED", "dateUpdated": "2026-06-01T12:44:56.455Z", "dateReserved": "2026-05-23T09:06:08.581Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-06-01T08:37:41.968Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.sshd:sshd-git", "product": "Apache MINA SSHD", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.17.1", "status": "affected", "version": "2.0.0", "versionType": "maven"}, {"lessThanOrEqual": "3.0.0-M3", "status": "affected", "version": "3.0.0-M1", "versionType": "maven"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:mina_sshd:*:*:*:*:*:*:*:*", "matchCriteriaId": "F5EB0B4D-9C31-4A5F-A476-B57D6C805FFB", "versionEndExcluding": "2.18.0", "versionStartIncluding": "2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:mina_sshd:3.0.0:m1:*:*:*:*:*:*", "matchCriteriaId": "32435A6F-3BD6-4AAB-93B1-0B1514419A50", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:mina_sshd:3.0.0:m2:*:*:*:*:*:*", "matchCriteriaId": "0E399FD6-9A33-4F78-AFCE-F46C7BBC56F1", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:mina_sshd:3.0.0:m3:*:*:*:*:*:*", "matchCriteriaId": "13419EBE-E6B4-4895-BF6C-FC910076CC7A", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory.\n\n\n\n\nApplications are affected if they use org.apache.sshd:sshd-git. Applications not using sshd-git are not affected.\n\n\n\n\nUsers are advised to upgrade affected applications to Apche MINA SSHD 2.18.0, which fixes the issue.\n\n\n\n\nThe issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M3 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git. Upgrade affected applications to 3.0.0-M4.\n\n\n\n\nWe would like to point out that a professional git server should not rely solely on file system layout and permissions, but should implement additional security controls to govern access to git repositories and operations allowed on particular git repositories."}, {"lang": "es", "value": "Vulnerabilidad de salto de ruta en el paquete Apache MINA SSHD sshd-git. La falta de validaci\u00f3n de ruta en git-upload-pack, git-receive-pack y otras operaciones de git permite a los usuarios autenticados por SSH acceder a repositorios git fuera del directorio ra\u00edz del servidor git configurado.\n\nLas aplicaciones se ven afectadas si utilizan org.apache.sshd:sshd-git. Las aplicaciones que no utilizan sshd-git no se ven afectadas.\n\nSe aconseja a los usuarios actualizar las aplicaciones afectadas a Apache MINA SSHD 2.18.0, que soluciona el problema.\n\nEl problema tambi\u00e9n est\u00e1 presente en los hitos de prelanzamiento 3.0.0-M1 a 3.0.0-M3 para una nueva versi\u00f3n principal pr\u00f3xima 3.0.0. De nuevo, las aplicaciones se ven afectadas solo si utilizan sshd-git. Actualice las aplicaciones afectadas a 3.0.0-M4.\n\nNos gustar\u00eda se\u00f1alar que un servidor git profesional no debe depender \u00fanicamente del dise\u00f1o y los permisos del sistema de archivos, sino que debe implementar controles de seguridad adicionales para gobernar el acceso a los repositorios git y las operaciones permitidas en repositorios git particulares."}], "id": "CVE-2026-48827", "lastModified": "2026-07-22T07:10:00.107", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security@apache.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48827", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-01T12:44:52.544626Z", "version": "2.0.3"}}]}, "published": "2026-06-01T09:16:20.307", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/910kq9ghm6js0k1yhhbrdm9sf5tqq9c9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/05/30/1"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.sshd/sshd-git: Apache MINA SSHD: Path Traversal Vulnerability Allows Access to Unauthorized Git Repositories", "id": "2483783", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483783"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory.\nApplications are affected if they use org.apache.sshd:sshd-git. Applications not using sshd-git are not affected.\nUsers are advised to upgrade affected applications to Apche MINA SSHD 2.18.0, which fixes the issue.\nThe issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M3 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git. Upgrade affected applications to 3.0.0-M4.\nWe would like to point out that a professional git server should not rely solely on file system layout and permissions, but should implement additional security controls to govern access to git repositories and operations allowed on particular git repositories.", "A flaw was found in Apache MINA SSHD bundle sshd-git. This path traversal vulnerability allows authenticated users to access Git repositories located outside the intended server root directory. The lack of proper path validation during Git operations, such as git-upload-pack and git-receive-pack, enables an attacker to bypass security restrictions. This could lead to unauthorized information disclosure from other repositories on the system."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, ensure the Git server environment is configured with strict access controls and isolation. Restrict operating system user accounts used for SSH Git access to their intended repository roots, potentially using chroot jails or similar mechanisms. Implement additional authorization layers to govern access to Git repositories and operations, preventing authenticated users from traversing outside the designated server root directory. Review and harden file system permissions to limit access to sensitive directories."}, "name": "CVE-2026-48827", "package_state": [{"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Fix deferred", "package_name": "sshd-git", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "sshd-git", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}], "public_date": "2026-06-01T08:37:41Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-48827\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48827\nhttps://lists.apache.org/thread/910kq9ghm6js0k1yhhbrdm9sf5tqq9c9"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.17.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0-M1,3.0.0-M3]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache MINA SSHD", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "mina_sshd", "vendor": "apache"}], "created": "2026-06-01T10:45:26.604590+00:00", "updated": "2026-06-01T11:00:07.358479+00:00", "vendors": ["apache", "apache$PRODUCT$mina_sshd"]}