Loading vulnerability…
Path Traversal in Apache MINA SSHD sshd-git
CVE-2026-48827 is a path traversal vulnerability in the Apache MINA SSHD sshd-git module, which provides Git-over-SSH server functionality. The flaw is caused by insufficient validation of user-supplied repository paths in git-upload-pack, git-receive-pack, and related git operations. In affected versions, traversal sequences can be used to escape the configured Git server root directory and resolve repositories elsewhere on the server filesystem. The issue affects applications that use org.apache.sshd:sshd-git, specifically Apache MINA SSHD versions 2.0.0 through 2.17.1 and pre-release versions 3.0.0-M1 through 3.0.0-M3. Applications that do not use sshd-git are not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an SSH-authenticated attacker to access Git repositories outside the intended server-side root directory. This can result in unauthorized read access to repository contents and, through receive-pack and related write-capable operations, unauthorized modification of repositories outside the configured root. The impact is especially significant in multi-tenant Git hosting environments that rely on the configured repository root for isolation between tenants or projects.
If you can’t patch tonight, do this now.
Until patched versions can be deployed, restrict or disable use of the sshd-git component where feasible. Limit which SSH-authenticated users can invoke Git operations, enforce repository-level authorization controls independent of filesystem layout, and monitor SSH and application logs for anomalous repository path requests indicative of traversal attempts. Do not rely solely on directory structure and filesystem permissions as the primary isolation boundary for Git repository access.
Patch, then assume compromise.
Upgrade affected applications using org.apache.sshd:sshd-git to Apache MINA SSHD 2.18.0 or later on the 2.x branch, or to 3.0.0-M4 or later on the 3.0.0 milestone branch. Ensure the deployed application actually updates the bundled sshd-git dependency and validate that repository path handling is constrained to the intended root after upgrade.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.