CVE-2026-93995: Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the server
Authenticated users can make Apache MINA SSHD sshd-git write a server file via a JGit archive command.
Improper input validation in Apache MINA SSHD's sshd-git component lets a remote authenticated user cause a file write on the server through JGit's "archive -o=file.zip" handling. CVE-2026-93995 affects versions up to 2.19.0 and 3.0.0-M1 through 3.0.0-M5, addressed in 2.20.0 and 3.0.0-M6. CVSS 3.1 is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Exploitation is not reported.
- CVE-2026-93995 is improper input validation in sshd-git.
- A JGit archive -o=file.zip request can write a file on the server.
- CVSS 3.1 is 6.5 with high integrity impact and low privileges.
- Releases before 2.20.0 and 3.0.0-M6 are affected.
Vulnerabilities mentionedAll →
- CVE-2026-939956.5—Incomplete git archive filter in Apache MINA SSHD writes filespublished · Apache MINA SSHD (sshd-git / org.apache.sshd:sshd-git)
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-93995 | Incomplete git archive filter in Apache MINA SSHD writes files Apache MINA SSHD's sshd-git component (GitPgmCommandFactory) lets authenticated SSH clients run a limited set of git commands through JGit on repositories stored on the server. A prior fix for CVE-2026-58624 blocked git archive --output and -o so the archive would be sent back over SSH instead of written on the server, but it missed the single-argument form -o=file.zip. An authenticated client can therefore still make JGit's archive command write a file on the server, a high integrity impact with no confidentiality or availability impact (CVSS 3.1 6.5). Only MINA SSHD servers configured with GitPgmCommandFactory on versions through 2.19.0, or 3.0.0-M1 through 3.0.0-M5, are affected. No public proof of concept is known and the issue is not in CISA KEV. |
Posted by Thomas Wolf on Sep 29 Severity: moderate CVSS 3.1: 6.5 (medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Affected versions: - Apache MINA SSHD before 2.20.0 - Apache MINA SSHD 3.0.0-M1 before 3.0.0-M6 Description: Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though class...
This source does not provide full text. Read it at seclists.org.