CVE-2026-48827 is a path traversal vulnerability in the Apache MINA SSHD sshd-git bundle. It arises from a lack of proper path validation in git-related operations such as git-upload-pack and git-receive-pack, which allows authenticated SSH users to access git repositories outside the intended root directory. This vulnerability affects only applications that use the sshd-git component (org.apache.sshd:sshd-git). The flaw is present in version 2.0.0 and pre-release milestones 3.0.0-M1 through 3.0.0-M3. The Apache Software Foundation has fixed this issue in version 2.18.0 and milestone 3.0.0-M4. The advisory also notes that relying solely on file system layout and permissions is insufficient for securing git servers and recommends implementing additional access controls.

The vulnerability allows an authenticated SSH user to perform path traversal attacks, potentially accessing git repositories outside the configured server root directory. This can lead to unauthorized read access to sensitive repositories. The CVSS 3.1 score is 7.1 (high), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact with limited integrity impact and no availability impact.

Upgrade affected applications using org.apache.sshd:sshd-git to Apache MINA SSHD version 2.18.0 or later, or to milestone 3.0.0-M4 or later for the upcoming major version. Since the vendor advisory does not explicitly state the remediation level, patch status is inferred from the upgrade recommendation. Additionally, implement security controls beyond file system permissions to govern access to git repositories and restrict allowed operations. Patch status is not explicitly confirmed in the advisory; therefore, check the vendor advisory for the latest remediation guidance.