CVE-2026-93995

Name of the Vulnerable Software and Affected Versions Apache MINA SSHD versions prior to 2.20.0 Apache MINA SSHD versions 3.0.0-M1 through 3.0.0-M5

Description Improper input validation in the sshd-git component allows authenticated SSH clients to potentially execute unauthorized git commands. The GitPgmCommandFactory class enables the remote execution of git commands via the JGit library on server-stored repositories. A previous attempt to restrict the archive command failed to remove the single-argument -o=file.zip version of the command parameter, allowing files to be written to the server.

Recommendations Upgrade to version 2.20.0. Upgrade to version 3.0.0-M6.