Bug 2503052 (CVE-2026-56452) - CVE-2026-56452 org.apache.sshd/sshd-scp: Apache MINA SSHD: Path traversal via SCP allows arbitrary file write
Summary: CVE-2026-56452 org.apache.sshd/sshd-scp: Apache MINA SSHD: Path traversal via...
Keywords:
Status: NEW
Alias: CVE-2026-56452
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2521828 2521829
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-20 21:02 UTC by OSIDB Bzimport
Modified: 2026-08-24 12:09 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-20 21:02:07 UTC 
Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH.




The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places.




The issue affects only

  *  applications that use no longer supported Apache MINA SSHD versions < 2.0.0 and use the SCP functions to receive files,
  *  or applications using sshd-scp in Apache MINA SSHD >= 2.0.0 to receive files.




Applications using Apache MINA SSHD >= 2.0.0 not using sshd-scp are not affected.




The issue is fixed in Apache MINA 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to these versions.
Note You need to log in before you can comment on or make changes to this bug.