CVE catalog

CVE-2026-56452

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP d

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.77% · Oct 25, 2026

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places. The issue affects only * applications that use no longer supported Apache MINA SSHD versions < 2.0.0 and use the SCP functions to receive files, * or applications using sshd-scp in Apache MINA SSHD >= 2.0.0 to receive files. Applications using Apache MINA SSHD >= 2.0.0 not using sshd-scp are not affected. The issue is fixed in Apache MINA 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to these versions.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpeminaNot reportedNot reportedvulnerable
Cpemina2Not reportedNot reportedvulnerable
Debianlibmina-sshd-java132.13.2-2vulnerable
Debianlibmina-sshd-java132.13.2-3vulnerable
Debianlibmina-sshd-java142.13.2-2vulnerable
Debianlibmina-sshd-java142.13.2-3vulnerable
Suseapache-sshdlinux enterprise module for development tools 15 sp72.19.0-150200.5.16.1fixed
Suseapache-sshdlinux enterprise high performance computing 15 sp4-espos2.19.0-150200.5.16.1fixed
Suseapache-sshdlinux enterprise high performance computing 15 sp4-ltss2.19.0-150200.5.16.1fixed
Suseapache-sshdlinux enterprise high performance computing 15 sp5-espos2.19.0-150200.5.16.1fixed
Suseapache-sshdlinux enterprise high performance computing 15 sp5-ltss2.19.0-150200.5.16.1fixed
Suseapache-sshdlinux enterprise server 15 sp4-ltss2.19.0-150200.5.16.1fixed
Suseapache-sshdlinux enterprise server 15 sp5-ltss2.19.0-150200.5.16.1fixed
Suseapache-sshdlinux enterprise server 15 sp6-ltss2.19.0-150200.5.16.1fixed
Suseapache-sshdlinux enterprise server for sap applications 15 sp42.19.0-150200.5.16.1fixed
Suseapache-sshdlinux enterprise server for sap applications 15 sp52.19.0-150200.5.16.1fixed
Suseapache-sshdlinux enterprise server for sap applications 15 sp62.19.0-150200.5.16.1fixed
Opensuseapache-sshdtumbleweed2.19.0-2.1fixed
Cpemina_sshdNot reportedNot reportedunknown

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Suseapache-sshdrpmlinux enterprise module for development tools 15 sp72.19.0-150200.5.16.1Not reportedSUSE-SU-2026:3339-1Not reported
Suseapache-sshdrpmlinux enterprise high performance computing 15 sp4-espos2.19.0-150200.5.16.1Not reportedSUSE-SU-2026:3339-1Not reported
Suseapache-sshdrpmlinux enterprise high performance computing 15 sp4-ltss2.19.0-150200.5.16.1Not reportedSUSE-SU-2026:3339-1Not reported
Suseapache-sshdrpmlinux enterprise high performance computing 15 sp5-espos2.19.0-150200.5.16.1Not reportedSUSE-SU-2026:3339-1Not reported
Suseapache-sshdrpmlinux enterprise high performance computing 15 sp5-ltss2.19.0-150200.5.16.1Not reportedSUSE-SU-2026:3339-1Not reported
Suseapache-sshdrpmlinux enterprise server 15 sp4-ltss2.19.0-150200.5.16.1Not reportedSUSE-SU-2026:3339-1Not reported
Suseapache-sshdrpmlinux enterprise server 15 sp5-ltss2.19.0-150200.5.16.1Not reportedSUSE-SU-2026:3339-1Not reported
Suseapache-sshdrpmlinux enterprise server 15 sp6-ltss2.19.0-150200.5.16.1Not reportedSUSE-SU-2026:3339-1Not reported
Suseapache-sshdrpmlinux enterprise server for sap applications 15 sp42.19.0-150200.5.16.1Not reportedSUSE-SU-2026:3339-1Not reported
Suseapache-sshdrpmlinux enterprise server for sap applications 15 sp52.19.0-150200.5.16.1Not reportedSUSE-SU-2026:3339-1Not reported
Suseapache-sshdrpmlinux enterprise server for sap applications 15 sp62.19.0-150200.5.16.1Not reportedSUSE-SU-2026:3339-1Not reported
Opensuseapache-sshdrpmtumbleweed2.19.0-2.1Not reportedOPENSUSE-SU-2026:11327-1Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [libmina-sshd-java]Affected
    Details (2)

    • 2.13.2-2 · all · trixie

      Affected

      nvd · libmina-sshd-java · debian · 13

    • 2.13.2-2 · all · trixie

      Affected

      nvd · libmina-sshd-java · debian · 13

[openSUSE Tumbleweed]

  • [apache-sshd-javadoc]Unknown

    Source package: [apache-sshd]

    Details (1)

    • 2.19.0-2.1 · noarch · tumbleweed

      Unknown · Fixed: 2.19.0-2.1

      Version impact unknown

      nvd · apache-sshd · opensuse · tumbleweed

  • [apache-sshd]Fixed

    Source package: [apache-sshd]

    Details (1)

    • 2.19.0-2.1 · noarch · tumbleweed

      Fixed · Fixed: 2.19.0-2.1

      nvd · apache-sshd · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]