Read the docs
TI-2026-19285 Aliases CVE-2026-23942

SFTP root escape via component-agnostic prefix check in ssh_sftpd

Priority LOW 30CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2. The SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root. This issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00385 32nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ErlangOTP3.0.1 and later—No fix listedCNA
ErlangOTP17.0 and later—No fix listedCNA
  • OTP VendorErlang Affected 3.0.1 and later Fixed in — No fix listed CNA
  • OTP VendorErlang Affected 17.0 and later Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*17.0 to before 26.2.5.18; 27.0 to before 27.3.4.9; 28.0 to before 28.4.1VulnerableErlang
cpe:2.3:a:erlang:erlang\/ssh:*:*:*:*:*:*:*:*3.0.1 to before 5.1.4.14; 5.2 to before 5.2.11.6; 5.5 – 5.5.1VulnerableErlang
  • cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* Versions 17.0 to before 26.2.5.18; 27.0 to before 27.3.4.9; 28.0 to before 28.4.1 Vulnerable ·Erlang
  • cpe:2.3:a:erlang:erlang\/ssh:*:*:*:*:*:*:*:* Versions 3.0.1 to before 5.1.4.14; 5.2 to before 5.2.11.6; 5.5 – 5.5.1 Vulnerable ·Erlang

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-23942

References

Patch 3

Advisory 3

Other 1

  • TI-2025-23504 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE KEVCVSS 3.1CRITICAL 10.0
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2017-14604 The Erlang otp TLS server answers with different TLS alerts to different error types in… CVSS 3.0MEDIUM 5.9
  • TI-2026-36669 Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash CVSS 4.0HIGH 8.8
  • TI-2022-17230 In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a… CVSS 3.1CRITICAL 9.8
  • TI-2016-08327 An issue was discovered in Erlang/OTP 18.x. CVSS 3.0CRITICAL 9.8
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences