Vulnerability Details CVE-2026-56452
Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH.
The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places.
The issue affects only
* applications that use no longer supported Apache MINA SSHD versions < 2.0.0 and use the SCP functions to receive files,
* or applications using sshd-scp in Apache MINA SSHD >= 2.0.0 to receive files.
Applications using Apache MINA SSHD >= 2.0.0 not using sshd-scp are not affected.
The issue is fixed in Apache MINA 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to these versions.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 28.4%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2026-56452
-
cpe:2.3:a:apache:mina_sshd:2.0.0
-
cpe:2.3:a:apache:mina_sshd:2.1.0
-
cpe:2.3:a:apache:mina_sshd:2.10.0
-
cpe:2.3:a:apache:mina_sshd:2.11.0
-
cpe:2.3:a:apache:mina_sshd:2.12.0
-
cpe:2.3:a:apache:mina_sshd:2.12.1
-
cpe:2.3:a:apache:mina_sshd:2.13.0
-
cpe:2.3:a:apache:mina_sshd:2.13.1
-
cpe:2.3:a:apache:mina_sshd:2.13.2
-
cpe:2.3:a:apache:mina_sshd:2.14.0
-
cpe:2.3:a:apache:mina_sshd:2.15.0
-
cpe:2.3:a:apache:mina_sshd:2.16.0
-
cpe:2.3:a:apache:mina_sshd:2.17.0
-
cpe:2.3:a:apache:mina_sshd:2.17.1
-
cpe:2.3:a:apache:mina_sshd:2.18.0
-
cpe:2.3:a:apache:mina_sshd:2.2.0
-
cpe:2.3:a:apache:mina_sshd:2.3.0
-
cpe:2.3:a:apache:mina_sshd:2.4.0
-
cpe:2.3:a:apache:mina_sshd:2.5.0
-
cpe:2.3:a:apache:mina_sshd:2.5.1
-
cpe:2.3:a:apache:mina_sshd:2.6.0
-
cpe:2.3:a:apache:mina_sshd:2.7.0
-
cpe:2.3:a:apache:mina_sshd:2.8.0
-
cpe:2.3:a:apache:mina_sshd:2.9.0
-
cpe:2.3:a:apache:mina_sshd:2.9.1
-
cpe:2.3:a:apache:mina_sshd:2.9.2
-
cpe:2.3:a:apache:mina_sshd:2.9.3
-
cpe:2.3:a:apache:mina_sshd:3.0.0