CVE-2026-48827: Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git

Synopsis

A path traversal vulnerability in the sshd-git component of Apache MINA SSHD allows authenticated SSH users to access git repositories outside the configured server root directory. The vulnerability is reachable over the network and requires only a low-privilege SSH account; no victim interaction is needed. Successful exploitation gives an attacker unauthorized read access to files and repositories outside the intended boundary, plus limited write capability. No upstream fix has been published yet; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The SSH service must be reachable over the network; an attacker contacts it remotely to initiate git operations.

• AuthenticationRequired

  Any valid low-privilege SSH account is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  The attacker exploits the flaw directly through their own SSH session; no other user needs to take any action.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; no race conditions or special environmental factors are required.

Blast Radius

• Reads git repository contents outside the server root, including source code, configuration files, and secrets committed to out-of-scope repositories.
• Writes or pushes malicious content into git repositories outside the intended boundary via git-receive-pack, corrupting history or injecting code.
• Exposes the filesystem layout beyond the git root, giving the attacker a map for follow-on attacks against other services or stored credentials.