Mention security fix

Resolution of CVE-2026-48827.

Author: tomaswolf

docs/changes/2.18.0.md

@@ -4,7 +4,7 @@
 
 * [GH-743](https://github.com/apache/mina-sshd/issues/743) Ensure the Java `ServiceLoader` use a singleton `SftpFileSystemProvider`
 * [GH-879](https://github.com/apache/mina-sshd/issues/879) Close SSH channel gracefully on exception in port forwarding
-* Improve handling of repository paths in `sshd-git`.
+* **Security**: Improve handling of repository paths in `sshd-git`. Resolves [CVE-2026-48827](https://www.cve.org/CVERecord?id=CVE-2026-48827), [announced](https://lists.apache.org/thread/910kq9ghm6js0k1yhhbrdm9sf5tqq9c9) 2026-05-30.
 
 ## New Features