Is CVE-2026-48827 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48827 being exploited in the wild.

How severe is CVE-2026-48827?

High severity, with a CVSS score of 7.1, published 1 June 2026.

Which products and versions are affected?

Apache MINA SSHD Versions prior to 2.18.0, and 3.0.0-M1 through 3.0.0-M3; org.apache.sshd:sshd-git (Maven) ECOSYSTEM:introduced=0,fixed=2.18.0.

Is there a fix for CVE-2026-48827?

Yes. org.apache.sshd:sshd-git (Maven): upgrade to 2.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48827 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48827?

Check whether you run Apache MINA SSHD or org.apache.sshd:sshd-git (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48827: Apache MINA SSHD path traversal in sshd-git bundle

CVE-2026-48827 · Severity: high · CVSS 7.1 · Published 2026-06-01

A vulnerability exists in the Apache MINA SSHD library's Git integration component, which is used to manage Git repositories over SSH. An authenticated user could bypass directory restrictions to access or modify Git repositories they are not authorized to see. This could lead to the exposure of sensitive source code or unauthorized changes to software projects.

Technologies: Apache MINA SSHD. Vendors: Apache, Maven.

Quick answers

Is CVE-2026-48827 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48827 being exploited in the wild.
How severe is CVE-2026-48827?: High severity, with a CVSS score of 7.1, published 1 June 2026.
Which products and versions are affected?: Apache MINA SSHD Versions prior to 2.18.0, and 3.0.0-M1 through 3.0.0-M3; org.apache.sshd:sshd-git (Maven) ECOSYSTEM:introduced=0,fixed=2.18.0.
Is there a fix for CVE-2026-48827?: Yes. org.apache.sshd:sshd-git (Maven): upgrade to 2.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48827 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48827?: Check whether you run Apache MINA SSHD or org.apache.sshd:sshd-git (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.sshd:sshd-git (Maven): upgrade to 2.18.0 or later

# set org.apache.sshd:sshd-git to 2.18.0 in your pom.xml or build.gradle

Technical details

A path traversal vulnerability (CWE-22) exists in the sshd-git bundle of Apache MINA SSHD due to insufficient path validation in Git operations such as git-upload-pack and git-receive-pack. An attacker authenticated over SSH can provide manipulated paths to escape the configured Git server root directory. This allows for unauthorized read and limited write access to repositories on the host file system. The issue is resolved in versions 2.18.0 and 3.0.0-M4.

Affected products

Apache MINA SSHD (sshd-git) 2.0.0 to 2.17.1, 3.0.0-M1 to 3.0.0-M3

Identifiers

CVE-2026-48827
GHSA-mw4m-qhpg-j82m

Timeline

2026-05-30: disclosed: Initial disclosure on oss-security mailing list
2026-06-01: advisory: GitHub and NVD advisories published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.