CVE-2026-93995 in MINA SSHD
Summary
by MITRE • 09/30/2026
Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH.
Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that authenticated SSH clients can remotely execute git commands via the JGit library on git repositories stored on the server. In CVE-2026-58624 this mechanism was restricted to only a few git commands, including "git archive" without "--output" or "-o" options such that the resulting archive would not be written on the server but instead sent back to the client over the SSH connection.
The fix done for CVE-2026-58624 was insufficient as it missed removing the single-argument "-o=file.zip" version of the command parameter from the "archive" command.
Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as CVE-2026-58624 resides within the Apache MINA SSHD library, specifically affecting versions up to 2.19.0 and the milestone releases from 3.0.0-M1 through 3.0.0-M5. This Java-based library provides robust client-side and server-side implementations of the Secure Shell protocol, enabling secure remote management and file transfer capabilities. A critical component within this ecosystem is the GitPgmCommandFactory class, which allows administrators to configure an Apache MINA SSHD server so that authenticated users can execute git commands remotely via the JGit library against repositories hosted on the server infrastructure. This functionality facilitates streamlined version control operations over encrypted channels but introduces significant security considerations regarding command injection and file system access if not properly constrained.
The core technical flaw stems from improper input validation within the archive subcommand of the git execution interface. A previous mitigation effort, designated as CVE-2026-58624, attempted to restrict remote git operations by limiting allowed commands primarily to "git archive" and enforcing strict parameter constraints. The intended security boundary required that any generated archives be streamed directly back to the client over the SSH connection rather than being written to disk on the server side. This restriction was designed to prevent arbitrary file writes and potential path traversal attacks that could compromise server integrity or lead to remote code execution through crafted archive files. However, this remediation effort proved insufficient because it failed to account for an alternative syntax variant of the output option.
Specifically, while the fix addressed cases where the output destination might be specified in ways that bypassed streaming logic, it overlooked the single-argument form of the output flag, denoted as "-o=file.zip". By allowing this specific parameter format without adequate validation or restriction to memory-based streams only, attackers can manipulate the git archive command to write files directly to arbitrary locations on the server's file system. This oversight effectively nullifies the protective measures implemented in the prior patch, leaving a window for unauthorized disk writes. The ability to specify an output path via this single-argument syntax enables adversaries to overwrite existing files or create new ones with malicious content, provided they have valid SSH authentication credentials and access to git repositories on the affected server.
The operational impact of this vulnerability is severe, as it transforms what should be a controlled read-only operation into a potential write vector for remote attackers. Successful exploitation allows an authenticated user to bypass intended sandboxing restrictions and perform arbitrary file system modifications. This can lead to data corruption, installation of web shells or backdoors if the attacker has access to writable directories such as web roots, or disruption of service by overwriting critical configuration files. The vulnerability aligns with CWE-20 Improper Input Validation, as the application fails to correctly sanitize or restrict user-supplied input that influences file system operations. Furthermore, from a threat intelligence perspective, this behavior maps to MITRE ATT&CK technique T1530 Data from Information Repositories and potentially T1059 Command and Scripting Interpreter if used in conjunction with other exploitation steps for persistence or lateral movement.
To mitigate this risk, organizations running Apache MINA SSHD must immediately upgrade their dependencies to version 2.20.0 or 3.0.0-M6, where the single-argument output option has been properly restricted or removed from the allowed command parameters. In addition to upgrading, administrators should review server configurations to ensure that the GitPgmCommandFactory is only enabled for users who strictly require git operations and apply principle of least privilege by restricting access to sensitive directories. Regular auditing of SSH authentication logs can help detect anomalous patterns indicative of exploitation attempts, such as repeated archive commands with varying output paths. Maintaining up-to-date software components remains the most effective defense against these types of logic flaws that arise from incomplete security patches.