Path traversal in the sshd-scp component of Apache MINA SSHD. (CVE-2026-56452)

The vulnerability (CVE-2026-56452) in Apache MINA SSHD's sshd-scp component arises from insufficient validation of filenames in SCP 'C' or 'D' commands during file reception. This allows a malicious sender to perform path traversal by including directory paths in filenames, resulting in files being written outside the intended directories. The flaw affects applications using unsupported Apache MINA SSHD versions earlier than 2.0.0 that utilize SCP receive functions, as well as applications using sshd-scp in versions 2.0.0 and later. Applications using Apache MINA SSHD 2.0.0 or later but not using sshd-scp are not affected. The vulnerability is addressed in Apache MINA SSHD versions 2.19.0 and 3.0.0-M5.

An attacker can exploit this vulnerability to write files to arbitrary locations on the target system by sending specially crafted SCP commands with path traversal sequences. This can lead to unauthorized file overwrite or placement, potentially impacting the integrity of the system or application data. The CVSS 3.1 score is 7.5 (medium severity), indicating a significant impact on integrity without requiring privileges or user interaction.

A fix is available in Apache MINA SSHD versions 2.19.0 and 3.0.0-M5. Affected users should upgrade to these versions to remediate the vulnerability. Applications using unsupported versions prior to 2.0.0 that use SCP receive functionality should upgrade to a supported fixed version. No other mitigation steps are indicated by the vendor advisory.