CVE-2026-58624

Description

A flaw was found in the sshd-git component of Apache MINA SSHD, specifically within its GitPgmCommandFactory. An authenticated SSH user could exploit improper input validation to execute arbitrary JGit commands. This allows an attacker to write files to arbitrary locations on the server, potentially leading to data integrity issues or further system compromise.

Statement

A flaw was found in the sshd-git component of Apache MINA SSHD, specifically within its GitPgmCommandFactory. An authenticated SSH user could exploit improper input validation to execute arbitrary JGit commands, including those that can write files to arbitrary locations on the server, such as git archive with the --output option. This vulnerability only affects SSH servers that have the GitPgmCommandFactory explicitly configured; servers without this configuration are not affected.

Mitigation

This vulnerability only affects Apache MINA SSHD servers that have the GitPgmCommandFactory configured. If your application does not use GitPgmCommandFactory, it is not affected. Removing or disabling the GitPgmCommandFactory configuration mitigates this issue.

Understanding the Weakness (CWE)

CWE-20

Availability

Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)

An attacker could provide unexpected values and cause a program crash or arbitrary control of resource allocation, leading to excessive consumption of resources such as memory and CPU.

Confidentiality

Technical Impact: Read Memory; Read Files or Directories

An attacker could read confidential data if they are able to control resource references.

Integrity,Confidentiality,Availability

Technical Impact: Modify Memory; Execute Unauthorized Code or Commands

An attacker could use malicious input to modify data or possibly alter control flow in unexpected ways, including arbitrary command execution.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.