CVE-2026-53422
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A vulnerability in the ssh_sftpd module of the SSH server in OTP (Erlang) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The issue stems from improper path handling in the SSH_FXP_REALPATH handler, which does not canonicalize the path before checking restrictions.
Risk Assessment
An attacker can exploit this flaw to enumerate the filesystem structure beyond the allowed root directory, potentially revealing the existence of sensitive files, directories, or mount points. This information may assist further attacks when combined with other vulnerabilities.
Recommendation
Immediately upgrade OTP to version 29.0.3, 28.5.0.3, or 27.3.4.14 (or later) and corresponding ssh versions (6.0.2, 5.5.2.2, or 5.2.11.9).
Other vulnerabilities in Erlang OTP ssh
See all- CVE-2026-54886Medium
An infinite loop vulnerability in the ssh_sftpd module of Erlang/OTP SSH allows an authenticated SFTP user to permanently block an SFTP channel. By sending extended data (SSH_MSG_CHANNEL_EXTENDED_DATA) with a non-zero type code, the attacker causes the handle_data/4 function to loop indefinitely, preventing further message processing on that channel.
- CVE-2026-48859Medium
Erlang/OTP ssh (ssh_auth, ssh_options modules) has an observable timing discrepancy vulnerability. With user_passwords or password option enabled, password checking for valid usernames takes ~300ms, while for invalid ones ~0ms, allowing unauthenticated remote username enumeration.
- CVE-2026-32147Medium
A Path Traversal vulnerability in the ssh_sftpd module of Erlang OTP ssh allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.
Original NVD description (English source)
Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths. An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points. The vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4. This issue affects OTP from OTP 17.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssh from 3.0.1 before 6.0.2, 5.5.2.2 and 5.2.11.9.