Vulnerability Description
Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places. The issue affects only * applications that use no longer supported Apache MINA SSHD versions < 2.0.0 and use the SCP functions to receive files, * or applications using sshd-scp in Apache MINA SSHD >= 2.0.0 to receive files. Applications using Apache MINA SSHD >= 2.0.0 not using sshd-scp are not affected. The issue is fixed in Apache MINA 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to these versions.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Mina Sshd | >= 2.0.0, < 2.19.0 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/xgoqvmksmd94fsqnzqjdtfjxf35os9noVendor AdvisoryMailing List
- http://www.openwall.com/lists/oss-security/2026/07/20/15Mailing ListThird Party Advisory
FAQ
What is CVE-2026-56452?
CVE-2026-56452 is a vulnerability with a CVSS score of 7.5 (HIGH). Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP d...
How severe is CVE-2026-56452?
CVE-2026-56452 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-56452?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Mina Sshd.