Threats tagged 'ghsa-9jwj-xh8m-f4vf'

Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 through 3.0.0-M5 contain an improper input validation vulnerability in the sshd-git component. This flaw affects the GitPgmCommandFactory class, which allows authenticated SSH clients to execute git commands remotely. The vulnerability is a result of incomplete mitigation of a previous issue (CVE-2026-58624), where the single-argument '-o=file.zip' form of the 'git archive' command was not properly restricted. This could lead to unauthorized command execution. Users are advised to upgrade to versions 2.20.0 or 3.0.0-M6 where the issue is fixed.