All vulnerabilities
CVE-2026-93995

Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the server

Apache Software Foundation Apache MINA SSHD
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.20.0Also 3.0.0-M6CVE List
Published30 Sep 2026Updated 30 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH.

Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that authenticated SSH clients can remotely execute git commands via the JGit library on git repositories stored on the server. In CVE-2026-58624 this mechanism was restricted to only a few git commands, including "git archive" without "--output" or "-o" options such that the resulting archive would not be written on the server but instead sent back to the client over the SSH connection.

The fix done for CVE-2026-58624 was insufficient as it missed removing the single-argument "-o=file.zip" version of the command parameter from the "archive" command.

Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

Text from CVE List

Affected versions 2

  • Apache MINA SSHDaffected: all versions before 2.20.0CVE List
  • Apache MINA SSHDaffected: 3.0.0-M1 before 3.0.0-M6CVE List

References 1