Loading vulnerability…
Path Traversal in Apache MINA SSHD SCP File Reception
CVE-2026-56452 is a path traversal vulnerability in the sshd-scp component of Apache MINA SSHD, a Java library that provides client-side and server-side SSH functionality. The flaw is in the implementation that receives files or directories via SCP: filenames supplied in SCP "C" or "D" commands were not properly validated. A malicious SCP sender can include path elements in those filenames, causing the receiving application to write files outside the intended destination directory and into attacker-chosen locations on the target system. The issue affects unsupported Apache MINA SSHD versions earlier than 2.0.0 when SCP receive functionality is used, and Apache MINA SSHD 2.0.0 and later when the sshd-scp component is used to receive files. Deployments on 2.0.0 and later that do not use sshd-scp are not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a malicious remote SCP sender to control where received files are written on the target system. This can lead to unauthorized file creation or overwrite outside the expected transfer directory, potentially compromising application integrity, altering configuration or data files accessible to the vulnerable process, and enabling follow-on attacks depending on the privileges of the receiving application and the sensitivity of writable locations.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, disable or avoid SCP-based file reception through sshd-scp where feasible and use alternative transfer mechanisms not affected by this flaw. Restrict which remote parties are permitted to send files, run the receiving service with the least privileges possible, and confine writable filesystem access so that unintended file writes cannot affect sensitive paths. Additional compensating controls should focus on limiting the impact of arbitrary file placement by the receiving process.
Patch, then assume compromise.
Upgrade Apache MINA SSHD to a fixed release. The issue is fixed in version 2.19.0 and 3.0.0-M5. Applications using unsupported releases earlier than 2.0.0 should migrate to a supported fixed version. For Apache MINA SSHD 2.0.0 and later, ensure any deployment using sshd-scp for file reception is updated to 2.19.0 or 3.0.0-M5 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.