Read the docs
TI-2026-36120 Aliases CVE-2026-48855

SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured

Priority LOW 12CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery. The SSH_FXP_READLINK handler in ssh_sftpd sends the raw result of file:read_link/2 to the client without calling chroot_filename/2 to strip the backend root prefix. An authenticated SFTP client can create a symlink inside the chroot pointing to /; ssh_sftpd resolves the target to the absolute backend root and stores it on disk. Reading the symlink back via SSH_FXP_READLINK returns that absolute path, for example /data/sftp, instead of the chrooted value /. The information disclosed is the absolute filesystem path of the SFTP root directory and of any symlink targets within it. No file contents, credentials, or access to paths outside the root directory are obtainable through this issue alone. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to ssh from 3.0.1 before 5.2.11.8, 5.5.2.1, and 6.0.1. Whether OTP before OTP 17.0, corresponding to ssh before 3.0.1, is affected is unknown.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00299 22nd percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ErlangOTP17.0 and later—No fix listedCNA
ErlangOTP3.0.1 and later—No fix listedCNA
  • OTP VendorErlang Affected 17.0 and later Fixed in — No fix listed CNA
  • OTP VendorErlang Affected 3.0.1 and later Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*17.0 to before 27.3.4.13; 28.0 to before 28.5.0.2; 29.0 to before 29.0.2VulnerableErlang
cpe:2.3:a:erlang:erlang\/ssh:*:*:*:*:*:*:*:*3.0.1 to before 5.2.11.8; 5.5 to before 5.5.2.1; 6.0 to before 6.0.1VulnerableErlang
  • cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* Versions 17.0 to before 27.3.4.13; 28.0 to before 28.5.0.2; 29.0 to before 29.0.2 Vulnerable ·Erlang
  • cpe:2.3:a:erlang:erlang\/ssh:*:*:*:*:*:*:*:* Versions 3.0.1 to before 5.2.11.8; 5.5 to before 5.5.2.1; 6.0 to before 6.0.1 Vulnerable ·Erlang

Remediation

Red Hat 1 advisory

  • RHSA-2026:63160 Released 2026-09-03 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images erlang27-27.3.4.17-1.hum1@aarch64, erlang27-27.3.4.17-1.hum1@src, erlang27-27.3.4.17-1.hum1@x86_64 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 16.2AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 17.1AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 18.0AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:63160

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48855

References

Patch 1

Advisory 3

Other 2

  • TI-2025-23504 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE KEVCVSS 3.1CRITICAL 10.0
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2017-14604 The Erlang otp TLS server answers with different TLS alerts to different error types in… CVSS 3.0MEDIUM 5.9
  • TI-2026-36669 Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash CVSS 4.0HIGH 8.8
  • TI-2022-17230 In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a… CVSS 3.1CRITICAL 9.8
  • TI-2016-08327 An issue was discovered in Erlang/OTP 18.x. CVSS 3.0CRITICAL 9.8
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences