CVE-2026-58624 describes an improper input validation vulnerability (CWE-20) in the GitPgmCommandFactory of Apache MINA SSHD, a Java SSH library. The vulnerable component allows authenticated SSH clients to execute any JGit command remotely, including commands capable of writing files to arbitrary locations on the server filesystem. This occurs because the factory did not restrict the set of executable commands, enabling potentially unsafe operations like 'git archive' with an --output parameter. The issue affects Apache MINA SSHD versions 2.0.0, 3.0.0-M1, and all versions from 2.0.0 through 2.18.0. The vulnerability is fixed in versions 2.19.0 and 3.0.0-M5 by enforcing a whitelist of safe commands and ignoring the --output argument for 'git archive', ensuring archives are sent only through the SSH channel to the client. Servers not configured with GitPgmCommandFactory are not vulnerable.

An authenticated SSH user on a vulnerable Apache MINA SSHD server configured with GitPgmCommandFactory can execute arbitrary JGit commands, including those that write files to arbitrary locations on the server. This can lead to unauthorized modification of server files and potential denial of service. The CVSS score of 5.4 (medium) reflects limited impact on confidentiality but notable integrity and availability impacts.

Upgrade affected Apache MINA SSHD servers to version 2.19.0 or 3.0.0-M5 or later, where this vulnerability is fixed by restricting executable commands to a safe whitelist and ignoring unsafe command arguments. If GitPgmCommandFactory is not used on the server, no action is required. Patch status is not explicitly stated but recommended versions indicate an official fix is available.