CVE-2026-48827 — Apache MINA SSHD sshd-git Path Traversal Info Disclosure

Multi-tenant SaaS applications are a tricky beast. From the outside, they look like a single product, but underneath the surface, they’re hosting data and configurations for dozens, hundreds, sometimes thousands of separate organisations. Every request that hits the backend has to know which tenant it belongs to and what data it should be allowed to touch. When that boundary is enforced cleanly, the platform works as advertised. When it isn’t, the consequences can be severe. A single authenticated user in one organisation might be able to peek into the files of every other organisation on the platform.

Part three of the thick client series hunts sensitive data in the Windows file system and registry, with tips on focusing tests on installers, login forms, and Remember Me storage.

CVE-2019-14994: a path traversal in Jira Service Desk lets customer-portal users reach the admin portal and read issues across all Jira projects; walks through affected versions and steps.

Web servers exposing their .git directory hand attackers the full repository history: the article covers finding exposed repos, mirroring them with wget, and recovering source and config data.

CVE-2026-45454: path traversal in SharePoint's Upload.aspx lets an authenticated attacker write into restricted libraries like the Master Page Gallery, escalating to RCE via ASPX webshells.

CVE-2026-48866: unauthenticated attackers can poison Gravity Forms entries with ../ sequences that delete arbitrary server files, including wp-config.php, when an admin removes the entry.