CVE-2026-23942
Path Traversal in Erlang OTP ssh_sftpd Allows Unauthorized Access
Publication date: 2026-03-13
Last updated on: 2026-04-06
Assigner: EEF
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| erlang | otp | From 3.0.1 (inc) to 5.5.1 (inc) |
| erlang | otp | 5.2.11.6 |
| erlang | otp | 5.1.4.14 |
| erlang | otp | From 17.0 (inc) to 28.4.1 (inc) |
| erlang | otp | 27.3.4.9 |
| erlang | otp | 26.2.5.18 |
| erlang | ssh | From 3.0.1 (inc) to 5.5.1 (inc) |
| erlang | ssh | 5.2.11.6 |
| erlang | ssh | 5.1.4.14 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Path Traversal issue in the Erlang OTP ssh_sftpd module. It occurs because the SFTP server uses string prefix matching instead of proper path component validation to check if a path is within the configured root directory.
As a result, authenticated users can access sibling directories that share a common name prefix with the root directory. For example, if the root is set to /home/user1, paths like /home/user10 or /home/user1_backup are incorrectly considered within the root, allowing unauthorized access.
How can this vulnerability impact me? :
This vulnerability allows authenticated users to access files and directories outside the intended restricted root directory by exploiting improper path validation.
This can lead to unauthorized access to sensitive data stored in sibling directories that should be inaccessible, potentially exposing confidential information or enabling further attacks.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know