{"id":"CVE-2023-35887","aliases":["GHSA-mjmq-gwgm-5qhm"],"url":"https://o3.security/vulnerability/CVE-2023-35887","summary":"Apache MINA SSHD: Information disclosure bugs with RootedFilesystem","details":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA.\n\nIn SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover \"exists/does not exist\" information about items outside the rooted tree via paths including parent navigation (\"..\") beyond the root, or involving symlinks.\n\nThis issue affects Apache MINA: from 1.0 before 2.10. Users are recommended to upgrade to 2.10\n","published":"2023-07-10T09:28:54.987Z","modified":"2026-07-15T01:49:17.125271643Z","cvss":{"score":5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.apache.sshd:sshd-common","fixedVersion":"2.9.3"},{"ecosystem":"Maven","name":"org.apache.sshd:sshd-sftp","fixedVersion":"2.9.3"},{"ecosystem":"Maven","name":"org.apache.sshd:sshd-core","fixedVersion":"2.1.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35887.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/b9qgtqvhnvgfpn0w1gz918p21p53tqk2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35887"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T01:49:17.125271643Z"}}