CVE-2026-93995: Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the server
Authenticated users can make Apache MINA SSHD sshd-git write a server file via a JGit archive command.
Improper input validation in Apache MINA SSHD's sshd-git component lets a remote authenticated user cause a file write on the server through JGit's "archive -o=file.zip" handling. CVE-2026-93995 affects versions up to 2.19.0 and 3.0.0-M1 through 3.0.0-M5, addressed in 2.20.0 and 3.0.0-M6. CVSS 3.1 is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Exploitation is not reported.
50