CVE-2026-56452
highpriority · track · 0EPSS 0.008 · 55 %ileEUUSEPSS · scored 2026-10-23
Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places. The issue affects only * applications that use no longer supported Apache MINA SSHD versions < 2.0.0 and use the SCP functions to receive files, * or applications using sshd-scp in Apache MINA SSHD >= 2.0.0 to receive files. Applications using Apache MINA SSHD >= 2.0.0 not using sshd-scp are not affected. The issue is fixed in Apache MINA 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to these versions.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2026/07/20/15cnnvd
- https://lists.apache.org/thread/xgoqvmksmd94fsqnzqjdtfjxf35os9nocnnvd
- https://lists.apache.org/thread/xgoqvmksmd94fsqnzqjdtfjxf35os9noenisa_euvd
- http://www.openwall.com/lists/oss-security/2026/07/20/15Mailing ListThird Party Advisorynvd
- https://lists.apache.org/thread/xgoqvmksmd94fsqnzqjdtfjxf35os9noVendor AdvisoryMailing Listnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan