Apache MINA SSHD’s git server component contains a path traversal flaw that operates only on Windows platforms. The validation logic introduced in CVE‑2026‑48827 is insufficient for Windows file path handling, allowing an authenticated remote SSH user to reference files and directories outside the intended server root. By requesting a repository path that traverses parent directories, an attacker can read or modify files that should be inaccessible, thereby compromising the confidentiality and integrity of stored code.

Any application that incorporates the org.apache.sshd:sshd-git library to host a git server on a Windows platform is vulnerable. Affected versions include Apache MINA SSHD 2.18.0 and all 2.18.x releases prior to 2.19.0, as well as pre‑release milestones 3.0.0‑M1 through 3.0.0‑M4. Applications that use other transport layers, do not run on Windows, or do not use sshd‑git are not affected. The issue is resolved in Apache MINA SSHD 2.19.0 and in milestone 3.0.0‑M5.

The vulnerability carries a CVSS score of 7.1, indicating high severity. The EPSS score is less than 1%, suggesting a low probability of exploitation in the near term, and it is not listed in the CISA KEV catalog. Attackers must first authenticate to the SSHD git server; once authenticated, they can leverage the Windows path traversal to access arbitrary files outside the designated repository root. The impact is confined to the authenticated scope, but the ability to read or modify any file within the server machine remains significant.