DEBIAN-CVE-2026-56452
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-56452
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-56452.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-56452
- Upstream
- Published
- 2026-07-20T21:16:48Z
- Modified
- 2026-09-14T17:03:20Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places. The issue affects only * applications that use no longer supported Apache MINA SSHD versions < 2.0.0 and use the SCP functions to receive files, * or applications using sshd-scp in Apache MINA SSHD >= 2.0.0 to receive files. Applications using Apache MINA SSHD >= 2.0.0 not using sshd-scp are not affected. The issue is fixed in Apache MINA 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to these versions.
- References
Affected packages
Debian:13 / libmina-sshd-java
Package
- Name
- libmina-sshd-java
- Purl
- pkg:deb/debian/libmina-sshd-java?arch=source&distro=trixie
Debian:14 / libmina-sshd-java
Package
- Name
- libmina-sshd-java
- Purl
- pkg:deb/debian/libmina-sshd-java?arch=source&distro=forky