Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. (CVE-2026-48827)

The vulnerability (CVE-2026-48827) in Apache MINA SSHD's sshd-git bundle arises from insufficient path validation in git-related SSH operations such as git-upload-pack and git-receive-pack. This allows authenticated users over SSH to perform path traversal and access git repositories outside the intended server root directory. The issue affects only applications that incorporate the org.apache.sshd:sshd-git module. The vulnerability is resolved in version 2.18.0 and milestone 3.0.0-M4. The advisory also notes that professional git servers should implement additional security controls beyond filesystem permissions to restrict repository access and operations.

An authenticated user with SSH access to the git server can exploit this vulnerability to access git repositories outside the configured root directory, potentially exposing sensitive data. The vulnerability has a CVSS 3.1 score of 7.1 (medium severity) with high confidentiality impact, low integrity impact, and no availability impact. There are no known exploits in the wild at this time.

Upgrade affected applications using org.apache.sshd:sshd-git to Apache MINA SSHD version 2.18.0 or later. For those using the 3.0.0 milestone releases, upgrade to 3.0.0-M4. Additionally, implement security controls beyond filesystem layout and permissions to govern access to git repositories and restrict allowed operations on them. No other immediate actions are indicated by the advisory.