{"schema_version": "1.6.1", "id": "CVE-2026-56452", "summary": "Path traversal in SCP file reception", "details": "Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH.\n\n\n\n\nThe implementation of receiving files or directories via SCP did not validate filenames in SCP \"C\" or \"D\" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places.\n\n\n\n\nThe issue affects only\n\n  *  applications that use no longer supported Apache MINA SSHD versions < 2.0.0 and use the SCP functions to receive files,\n  *  or applications using sshd-scp in Apache MINA SSHD >= 2.0.0 to receive files.\n\n\n\n\nApplications using Apache MINA SSHD >= 2.0.0 not using sshd-scp are not affected.\n\n\n\n\nThe issue is fixed in Apache MINA 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to these versions.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "0"}, {"last_affected": "0"}]}, {"type": "SEMVER", "events": [{"introduced": "3.0.0-M1"}, {"last_affected": "3.0.0-M1"}]}]}], "references": [{"type": "WEB", "url": "https://lists.apache.org/thread/xgoqvmksmd94fsqnzqjdtfjxf35os9no"}]}