{"id":"CVE-2023-35887","aliases":["GHSA-mjmq-gwgm-5qhm"],"url":"https://o3.security/vulnerability/CVE-2023-35887","summary":"Apache MINA SSHD: Information disclosure bugs with RootedFilesystem","details":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA.\n\nIn SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover \"exists/does not exist\" information about items outside the rooted tree via paths including parent navigation (\"..\") beyond the root, or involving symlinks.\n\nThis issue affects Apache MINA: from 1.0 before 2.9.3 Users are recommended to upgrade to 2.9.3\n\nUntil version 2.1.0, some of the code affected by this vulnerability appeared in org.apache.sshd:sshd-core. Version 2.1.0 contains a [commit](https://github.com/apache/mina-sshd/commit/10de190e7d3f9189deb76b8d08c72334a1fe2df0) where the code was moved to the package org.apache.sshd:sshd-common, which did not exist until version 2.1.0.\n","published":"2023-07-10T09:28:54.987Z","modified":"2026-08-12T03:51:19.797474197Z","cvss":{"score":5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"},"epss":{"score":0.013,"percentile":0.69057,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.apache.sshd:sshd-common","fixedVersion":"2.9.3"},{"ecosystem":"Maven","name":"org.apache.sshd:sshd-sftp","fixedVersion":"2.9.3"},{"ecosystem":"Maven","name":"org.apache.sshd:sshd-core","fixedVersion":"2.1.0"}],"fix":{"url":"https://github.com/apache/mina-sshd/pull/362","label":"apache/mina-sshd#362"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35887.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/b9qgtqvhnvgfpn0w1gz918p21p53tqk2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35887"},{"type":"WEB","url":"https://github.com/apache/mina-sshd/pull/362"},{"type":"WEB","url":"https://github.com/apache/mina-sshd/commit/10de190e7d3f9189deb76b8d08c72334a1fe2df0"},{"type":"WEB","url":"https://github.com/apache/mina-sshd/commit/a61e93035f06bff8fc622ad94870fb773d48b9f0"},{"type":"WEB","url":"https://github.com/apache/mina-sshd/commit/c20739b43aab0f7bf2ccad982a6cb37b9d5a8a0b"},{"type":"PACKAGE","url":"https://github.com/apache/mina-sshd"},{"type":"WEB","url":"https://issues.apache.org/jira/browse/SSHD-1324"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:19.797474197Z"}}