The vulnerability identified as CVE-2026-48827 is a CWE-22 path traversal issue in Apache MINA SSHD's sshd-git component. It arises from a lack of proper path validation in git-related SSH operations, enabling authenticated users to access git repositories outside the intended root directory. This affects versions 2.0.0 and pre-release milestones 3.0.0-M1 to 3.0.0-M3 of sshd-git. The Apache Software Foundation has addressed this vulnerability in version 2.18.0 and milestone 3.0.0-M4. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction. Confidentiality impact is high, integrity impact is low, and availability is not affected.

An authenticated user with SSH access to the git server can exploit this vulnerability to access git repositories outside the configured root directory. This can lead to unauthorized disclosure of repository contents (high confidentiality impact) and partial integrity impact. There is no impact on availability. The vulnerability affects only applications using the sshd-git component of Apache MINA SSHD. No known exploits in the wild have been reported.

A fix is available by upgrading affected applications to Apache MINA SSHD version 2.18.0 or later, or to milestone 3.0.0-M4 for the upcoming major version. Users should apply these updates promptly. Additionally, professional git servers should implement security controls beyond filesystem permissions to restrict access to git repositories and allowed operations. Patch status is not explicitly stated in the vendor advisory but the recommendation to upgrade to fixed versions confirms an official fix is available.