CVE-2026-56452: Apache MINA SSHD Path Traversal Flaw

CVE-2026-56452 Overview

CVE-2026-56452 is a path traversal vulnerability [CWE-22] in the sshd-scp component of Apache MINA SSHD, a Java library that implements client-side and server-side SSH. The implementation of receiving files or directories through Secure Copy Protocol (SCP) failed to validate filenames contained in SCP C (file) and D (directory) commands. A malicious SCP sender can supply filenames containing directory path segments, causing the receiver to write files outside the intended destination directory. The flaw affects unsupported Apache MINA SSHD versions prior to 2.0.0 and any application using sshd-scp in Apache MINA SSHD 2.0.0 or later to receive files. Applications on 2.0.0+ that do not use sshd-scp are unaffected.

Critical Impact
An attacker acting as an SCP sender can write attacker-controlled files to arbitrary locations on the receiving host, enabling code execution paths through overwrites of configuration files, scripts, or binaries.

Affected Products

Apache MINA SSHD versions < 2.0.0 (no longer supported) using SCP receive functions
Apache MINA SSHD versions >= 2.0.0 and < 2.19.0 using the sshd-scp module
Apache MINA SSHD 3.0.0 milestone releases prior to 3.0.0-M5

Discovery Timeline

2026-07-20 - CVE-2026-56452 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-56452

Vulnerability Analysis

SCP transfers files using a simple text protocol in which the sender issues control messages that describe each object being transferred. A C command declares an incoming regular file with a permission mode, size, and filename. A D command declares an incoming directory. Well-behaved SCP receivers treat the filename as a single path component and reject any component containing separators such as / or ...

The sshd-scp component in Apache MINA SSHD did not enforce this constraint. When the receiver parsed a C or D command, it concatenated the attacker-supplied filename with the destination directory without validating that the result stayed within that directory. A sender can supply a filename such as ../../etc/cron.d/payload and the receiver writes the file to that resolved location using the process privileges of the SSH server.

The CWE-22 classification captures the root behavior: improper limitation of a pathname to a restricted directory. Because SCP D commands can also create directories, an attacker can stage arbitrary directory structures anywhere the receiving process can write.

Root Cause

The receiver code path for SCP C and D commands trusted the filename supplied by the remote peer. It performed no check that the filename was a single path component and no canonicalization check that the final resolved path remained a descendant of the intended destination directory.

Attack Vector

Exploitation requires the victim application to invoke sshd-scp receive functionality against an attacker-controlled sender, or to accept SCP uploads from an authenticated client that the attacker controls. No user interaction is required on the receiver side once the SCP session is established. The attack is network-reachable wherever the SSH service is exposed. The impact is limited to integrity: attackers can write files but the vulnerability itself does not directly disclose data or crash the service. Secondary code execution is achievable when the written files land in locations processed by other privileged components.

Detection Methods for CVE-2026-56452

Indicators of Compromise

Files written outside the configured SCP destination directory by the process running Apache MINA SSHD
New or modified files in sensitive paths such as ~/.ssh/authorized_keys, /etc/cron.d/, /etc/init.d/, or web application document roots following an SCP session
SSH session logs showing SCP transfers from untrusted senders immediately preceding unexpected file changes

Detection Strategies

Enable verbose logging on the Apache MINA SSHD server and alert on SCP C or D command filenames that contain /, \, or .. sequences
Deploy file integrity monitoring on directories outside the SCP upload area that should never be modified by the SSH service account
Correlate authenticated SSH sessions with filesystem writes performed by the JVM process hosting sshd-scp

Monitoring Recommendations

Inventory all internal Java applications that embed Apache MINA SSHD and record which of them link the sshd-scp artifact
Monitor dependency manifests such as pom.xml and build.gradle for versions of sshd-scp less than 2.19.0 or 3.0.0-M5
Track outbound and inbound SCP sessions where the receiver runs Apache MINA SSHD and log the raw SCP protocol messages for forensic review

How to Mitigate CVE-2026-56452

Immediate Actions Required

Upgrade Apache MINA SSHD to version 2.19.0 or 3.0.0-M5, which contain the fix for CVE-2026-56452
If upgrade is not immediately possible, disable the SCP subsystem in the server configuration and require clients to use SFTP instead
Restrict SCP receive operations to authenticated peers on trusted networks until patching is complete

Patch Information

The Apache MINA project fixed the issue in Apache MINA SSHD 2.19.0 and 3.0.0-M5. Applications embedding sshd-scp must update the dependency and redeploy. Refer to the Apache Security Mailing List Update and the OpenWall OSS Security Notice for the vendor announcement.

Workarounds

Remove the sshd-scp module from the application classpath if SCP receive functionality is not required
Run the SSH service under a low-privilege account and confine its writable paths with mandatory access controls such as AppArmor or SELinux
Front the SSH endpoint with a jump host or bastion that only forwards sessions from authenticated administrative users

bash

# Configuration example: Maven dependency update to the fixed version
<dependency>
    <groupId>org.apache.sshd</groupId>
    <artifactId>sshd-scp</artifactId>
    <version>2.19.0</version>
</dependency>