A path traversal flaw in the Apache MINA SSHD sshd-git bundle allows a user authenticated over SSH to invoke git-upload-pack, git-receive-pack and related git operations without proper path validation. This flaw can be used to read or modify files outside the configured git server root directory, thereby compromising both confidentiality and integrity of data stored on the server. The weakness is classified as CWE‑22: Path Traversal.

The vulnerability affects users of the Apache MINA SSHD project, specifically those employing the sshd‑git module. Any installation that includes sshd‑git prior to version 2.18.0 is impacted, as are pre‑release milestones 3.0.0‑M1 through 3.0.0‑M3. The issue does not apply to applications that have not integrated sshd‑git.

The recorded CVSS score of 7.1 indicates a high severity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only authenticated SSH access to the git server, which is normally granted to developers or system administrators. Once accessed, an attacker can traverse to arbitrary filesystem locations and read or write files, potentially leading to disclosure or tampering of critical data. The ease of exploitation and lack of additional safeguards make the risk substantial for environments that expose sshd‑git services.