CVE-2026-56452

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places. The issue affects only * applications that use no longer supported Apache MINA SSHD versions < 2.0.0 and use the SCP functions to receive files, * or applications using sshd-scp in Apache MINA SSHD >= 2.0.0 to receive files. Applications using Apache MINA SSHD >= 2.0.0 not using sshd-scp are not affected. The issue is fixed in Apache MINA 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to these versions.

• CWE-22
• CWE-73

• https://lists.apache.org/thread/xgoqvmksmd94fsqnzqjdtfjxf35os9noVendor Advisory, Mailing List
• http://www.openwall.com/lists/oss-security/2026/07/20/15Mailing List, Third Party Advisory

Published

Jul 20, 2026

Last Modified

Jul 27, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-56446MISP allowed a site administrator to configure an arbitrary …7.2
• CVE-2026-56447MISP allowed an authenticated site administrator to set the …7.2
• CVE-2026-56448A path traversal vulnerability exists in AIL Framework befor…8.3
• CVE-2026-5645A weakness has been identified in projectworlds Car Rental S…7.3
• CVE-2026-56450AIL did not restrict repeated failed attempts to verify a tw…5.1
• CVE-2026-56451A vulnerability has been identified in Opcenter X (All versi…10
• CVE-2026-56453HCL DFXAnalytics is affected by an Account Takeover via Resp…9.8
• CVE-2026-56454HCL DFXAnalytics is affected by a Deprecated Protocol vulner…7.5
• CVE-2026-56455HCL DFXAnalytics is affected by a Buffer Overflow vulnerabil…7.5
• CVE-2026-56456HCL DFXAnalytics is affected by an Internal File Path Disclo…5.3
• CVE-2026-56457HCL DevOps Deploy / HCL Launch is susceptible to an exposure…4.3
• CVE-2026-56458HCL DevOps Deploy uses Cross-Origin Resource Sharing (CORS) …7.5