Apache MINA SSHD contains an improper input validation flaw in the sshd-git component that allows authenticated SSH users to run the git archive command with the single‑argument '-o=file.zip'. This causes the JGit library to create or overwrite a ZIP file directly on the server filesystem. The ability to write arbitrary files from a remote client can be leveraged to deploy malicious binaries, alter configuration files, or otherwise compromise the integrity of the server. The weakness is a classic case of CWE‑20: Improper Input Validation.

Affected products are Apache Software Foundation's Apache MINA SSHD, specifically versions up to and including 2.19.0 and the milestone releases 3.0.0‑M1 through 3.0.0‑M5. The vulnerability resides in the sshd-git module which is used to enable remote git command execution on a server.

The CVSS base score of 6.5 indicates a moderate severity. The EPSS score is not available, suggesting a lack of recent exploitation data, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be able to authenticate to the SSH server and have permissions to run git commands on an existing repository; there are no known public exploits, so the risk level remains moderate but not negligible.