Description
Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH.




Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute git commands via the JGit library on git repositories stored on the server.




This GitPgmCommandFactory allowed a user authenticated via SSH to run any JGit command available, including commands that could write files at arbitrary places such as git archive with the --output option.




Affected are SSH servers implemented with Apache MINA SSHD and using the GitPgmCommandFactory. If the GitPgmCommandFactory is not configured on the server, the server is not affected.




It is recommended to upgrade affected servers to Apache MINA SSHD 2.19.0 or 3.0.0-M5, which fix this issue.




The issue is fixed by restricting the available commands to a small whitelist of uncritical commands (such as git log). git archive is also allowed, but its --output argument is ignored and the archive is always sent through the SSH channel to the client.
Published: 2026-07-20
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Improper input validation in the sshd-git component of Apache MINA SSHD allows an authenticated SSH user to execute arbitrary JGit commands, including those that can write files to arbitrary locations on the server. This input validation flaw (CWE‑20) enables an attacker to place or overwrite files, potentially leading to persistence, sabotage, or further code execution if the written files are interpreted by the system.

Affected Systems

The vulnerability affects servers built with Apache MINA SSHD that have the GitPgmCommandFactory enabled to allow SSH clients to run JGit commands. Any version of Apache MINA SSHD prior to 2.19.0 and 3.0.0‑M5 is susceptible; the fixed versions are 2.19.0, 3.0.0‑M5, and later releases.

Risk and Exploitability

The likely attack vector is an authenticated SSH session. The CVSS score of 5.4 indicates moderate severity. The EPSS score below 1% shows a low but non‑zero chance of exploitation. It is not listed in CISA KEV, reducing the likelihood of widespread active exploitation. This issue requires an authenticated SSH login and can be leveraged to write arbitrary files, but it does not provide immediate remote code execution without additional steps.

Generated by OpenCVE AI on July 30, 2026 at 18:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apache MINA SSHD to version 2.19.0 or later (including 3.0.0‑M5) to apply the vendor fix that whitelists safe commands and removes the ability to specify arbitrary output paths for git archive.
  • If an upgrade is not immediately possible, disable or remove the GitPgmCommandFactory configuration from the SSH server so that clients cannot invoke JGit commands.
  • If disabling the factory is impractical, re‑configure it to allow only a minimal set of harmless commands such as git log and ensuring that git archive’s --output option is ignored or blocked.

Generated by OpenCVE AI on July 30, 2026 at 18:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache mina Sshd
Vendors & Products Apache
Apache mina Sshd

Tue, 21 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 20 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Description Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute git commands via the JGit library on git repositories stored on the server. This GitPgmCommandFactory allowed a user authenticated via SSH to run any JGit command available, including commands that could write files at arbitrary places such as git archive with the --output option. Affected are SSH servers implemented with Apache MINA SSHD and using the GitPgmCommandFactory. If the GitPgmCommandFactory is not configured on the server, the server is not affected. It is recommended to upgrade affected servers to Apache MINA SSHD 2.19.0 or 3.0.0-M5, which fix this issue. The issue is fixed by restricting the available commands to a small whitelist of uncritical commands (such as git log). git archive is also allowed, but its --output argument is ignored and the archive is always sent through the SSH channel to the client.
Title Apache MINA SSHD: Remote execution of JGit commands can write files on the server
Weaknesses CWE-20
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}

Subscriptions

Apache Mina Sshd
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-07-21T17:15:42.543Z

Reserved: 2026-07-01T19:10:57.224Z

Link: CVE-2026-58624

cve-icon Vulnrichment

Updated: 2026-07-20T22:20:03.015Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T18:30:05Z

Weaknesses
  • CWE-20

    Improper Input Validation