CVE-2026-48827

There is a path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory.

Applications are affected if they use org.apache.sshd:sshd-git. Applications not using sshd-git are not affected.

Users are advised to upgrade affected applications to Apche MINA SSHD 2.18.0, which fixes the issue.

The issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M3 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git. Upgrade affected applications to 3.0.0-M4.

Apache MINA SSHD bundle sshd-git would like to point out that a professional git server should not rely solely on file system layout and permissions, but should implement additional security controls to govern access to git repositories and operations allowed on particular git repositories.

Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory. Applications are affected if they use org.apache.sshd:sshd-git. Applications not using sshd-git are not affected. Users are advised to upgrade affected applications to Apche MINA SSHD 2.18.0, which fixes the issue. The issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M3 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git. Upgrade affected applications to 3.0.0-M4. We would like to point out that a professional git server should not rely solely on file system layout and permissions, but should implement additional security controls to govern access to git repositories and operations allowed on particular git repositories.

These are all security issues fixed in the apache-sshd-2.18.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for apache-sshd, jpgpj fixes the following issues

• CVE-2020-36843: no check performed on scalar to avoid signature malleability (bsc#1239551).
• CVE-2026-48827: Apache MINA SSHD: Path traversal in org.apache.sshd: sshd-git (bsc#1267018).

Changes for jpgpj:

• Initial packaging with v1.3

Changes for apache-sshd:

• Update to upstream version 2.18.0

• Bug Fixes

• GH-743 Ensure the Java ServiceLoader use a singleton SftpFileSystemProvider
• GH-879 Close SSH channel gracefully on exception in port forwarding
• Security: Improve handling of repository paths in sshd-git. Resolves CVE-2026-48827, bsc#1267018

• New Features

• GH-892 Align handling certificates without principals with OpenSSH 10.3

• Update to upstream version 2.17.1

• Changes

• GH-875 Use Apache Parent POM 36

• Update to upstream version 2.17.0

• GH-469, SSHD-897 Fix duplicate character echo with interactive shells
• GH-721 SSH client: schedule session timeout checks on demand only
• GH-807 Handle 'verified' flag for sk-* keys
• GH-809 Fix server-side authentication for FIDO/U2F sk-* keys with flags in authorized_keys
• GH-827 Don't fail on invalid known_hosts lines; log and skip them
• GH-830 EC public keys: let Bouncy Castle generate X.509 encodings with the curve OID as algorithm parameter
• GH-855 SFTP: use a single SftpClient per SftpFileSystem
• GH-856 Fix using ed25519 with BC-FIPS
• GH-861 SFTP client: prevent sending zero-length writes in SftpOutputStreamAsync
• SSHD-1348 Fix zero-length SFTP reads
• SSHD-1349 Bump PMD to 7.20.0 to avoid StackOverflowError when compiling on Java 26-ea
• GH-814 Include a fix for CVE-2020-36843 (bsc#1239551) in optional dependency net.i2p.crypto:eddsa:0.3.0: perform the missing range check in Apache MINA SSHD before delegating to the signature verification in net.i2p.crypto:eddsa:0.3.0. This means that using net.i2p.crypto:eddsa:0.3.0 in Apache MINA SSHD is safe despite that CVE in the dependency.
• GH-865 replace %h in HostName SSH config

• Update to upstream version 2.16.0

• Changes of version 2.16.0

• bugfix: fix cert auth failed bug
• GH-664: Skip MAC negotiation if an AEAD cipher was negotiated
• GH-663: Fix a race in IoSession creation
• Also test sshd-mina using mina-core 2.2.4
• ScpShell fixes; SFTP append mode for buggy servers
• fix sources.jar Reproducible Builds issue
• GH-700: Fix race in AbstractCloseable.doCloseImmediately()
• GH-705: Make ChannelToPortHandler accessible to user code
• GH-709: Handle keep-alive channel messages sent by an old OpenSSH server
• GH-727: supply default port for proxyJump if no HostConfigEntry
• GH-733: Fix SftpRemotePathChannel.transferTo
• GH-725: Added commandTimeoutMillis in executeRemoteCommand
• GH-774: Fix WritePendingException
• #771 Avoid NoClassDefFoundError: net/i2p/crypto/eddsa/EdDSAPublicKey
• GH-516: Fix filesystem-id parsing in getFileSystem(URI)
• GH-754: Don't close DefaultForwarder on bind error
• Close repository after usage in GitPackCommand
• Trigger ClientChannelEvent.Timeout and ClientSessionEvent.TIMEOUT independently to host's program cycle times

• Changes of version 2.15.0

• GH-618: Fix reading an OpenSshCertificate from a Buffer
• Add interface to configure details of JGit's pack implementation
• ML-KEM key exchanges using Bouncy Castle 1.79
• GH-628: Fix reading directories with trailing blanks in the name
• GH-626: Enable Streaming.Async for ChannelDirectTcpip
• Sftp server 'ls' command timeout
• GH-636: Handle unknown key types in known_hosts
• GH-643: provide interfaces for caching file attributes on paths
• Bouncy Castle EdDSA / Ed25519 Support
• Abstract revoked key handling in KnownHostsServerKeyVerifier

• Fix an incompletely interpolated dependency with maven 4.0.0-rc-4
• Fix wrong invocation of xmvn-subst
• Updated to upstream version 2.14.0
• Changes in version 2.14.0

• GH-524 Performance improvements
• GH-533 Fix multi-step authentication
• GH-582 Fix…