{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "libmina-sshd-java"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "libmina-sshd-java"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH.     The implementation of receiving files or directories via SCP did not validate filenames in SCP \"C\" or \"D\" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places.     The issue affects only    *  applications that use no longer supported Apache MINA SSHD versions \u003c 2.0.0 and use the SCP functions to receive files,   *  or applications using sshd-scp in Apache MINA SSHD \u003e= 2.0.0 to receive files.     Applications using Apache MINA SSHD \u003e= 2.0.0 not using sshd-scp are not affected.     The issue is fixed in Apache MINA 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to these versions.",
  "id": "DEBIAN-CVE-2026-56452",
  "modified": "2026-09-14T16:47:42.897328820Z",
  "published": "2026-07-20T21:16:48.820Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-56452"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-56452"
  ]
}