Apache fixes MINA SSHD path traversal and LDAP TLS hostname verification flaws

Apache disclosed CVE-2026-48827, a path traversal flaw in the org.apache.sshd:sshd-git bundle of Apache MINA SSHD that lets an SSH-authenticated user escape the configured Git root by supplying repository paths containing traversal sequences such as ../. The issue affects sshd-git versions 2.0.0 through 2.17.1 and 3.0.0-M1 through 3.0.0-M3, impacting git-upload-pack, git-receive-pack, and related operations. Successful exploitation can expose arbitrary Git repositories on the server filesystem and, in some cases, allow unauthorized writes outside the intended root. Apache fixed the bug in versions 2.18.0 and 3.0.0-M4 by adding centralized path validation, and noted that deployments using Apache MINA SSHD without the non-default sshd-git module are not affected.

Apache also disclosed CVE-2026-35563 in the Apache Directory LDAP API client, where versions 2.0.0 through 2.1.7 failed to verify whether a TLS server certificate matched the intended LDAP hostname. Because the client would accept a trusted certificate issued for an unrelated host, an attacker with man-in-the-middle network access could impersonate the LDAP server and fully compromise the connection. The flaw is tracked as CWE-297, and Apache said hostname verification is now enforced in a newer LDAP API release. The disclosures highlight two separate Apache security fixes affecting repository isolation in SSH-based Git services and certificate validation in LDAP client connections.