ZeroDay Findings
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-48827

Path traversal vulnerability in Apache MINA SSHD bundle sshd-git.

Published Jun 1, 2026 · catalog updated Jul 22, 2026 · mina sshd

Check if you run it

No confirmed exploitation is on record for CVE-2026-48827. EPSS is 0.78%. Act only if a listed version of mina sshd is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.1
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.78%
Remediation
Advisory link
Affected products
cpe apache/mina sshd

Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory. Applications are affected if they use org.apache.sshd:sshd-git. Applications not using sshd-git are not affected. Users are advised to upgrade affected applications to Apche MINA SSHD 2.18.0, which fixes the issue. The issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M3 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git. Upgrade affected applications to 3.0.0-M4. We would like to point out that a professional git server should not rely solely on file system layout and permissions, but should implement additional security controls to govern access to git repositories and operations allowed on particular git repositories.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe apache/mina sshdversion unspecified
  • cpe apache/mina sshd3.0.0

How to fix CVE-2026-48827

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-48827. EPSS is 0.78%. Act only if a listed version of mina sshd is installed.

Which versions are affected?

Compare what you have installed with apache/mina sshd 3.0.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-22: Path Traversal. EPSS 0.78%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 1, 2026 · NIST NVD

    Detected

    Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory. Applications are affected if they use org.apache.sshd:sshd-git. Applications not using sshd-git are not affected. Users are advised to

  2. Jul 22, 2026 · NIST NVD

    Updated

    Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory. Applications are affected if they use org.apache.sshd:sshd-git. Applications not using sshd-git are not affected. Users are advised to

Sources

  • FIRST EPSSExploitation probabilityCVE-2026-48827

    30-day exploitation probability 0.8%

    first.org
  • NIST NVDVulnerability recordCVE-2026-48827

    Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory. Applicatio

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.