Is CVE-2026-23942 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23942 being exploited in the wild.

How severe is CVE-2026-23942?

Medium severity, with a CVSS score of 5.4, published 13 March 2026.

Which products and versions are affected?

Erlang/OTP 17.0 to 26.2.5.17, 27.0 to 27.3.4.8, 28.0 to 28.4.0.

Is there a fix for CVE-2026-23942?

A patch was published on 2026-03-13: Patches released in multiple OTP branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-23942 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-23942?

Check whether you run Erlang/OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23942: Erlang OTP path traversal in ssh_sftpd root directory validation

CVE-2026-23942 · Severity: medium · CVSS 5.4 · Published 2026-03-13

A vulnerability in the Erlang/OTP SFTP server allows authenticated users to access files outside of their assigned home directory. This occurs because the server incorrectly validates folder names, allowing access to any directory that starts with the same name as the restricted root folder (for example, accessing 'user1_backup' when only 'user1' should be allowed). This could lead to unauthorized data exposure or modification if sensitive information is stored in adjacent directories on the same server.

Technologies: Erlang/OTP. Vendors: Erlang.

Quick answers

Is CVE-2026-23942 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23942 being exploited in the wild.
How severe is CVE-2026-23942?: Medium severity, with a CVSS score of 5.4, published 13 March 2026.
Which products and versions are affected?: Erlang/OTP 17.0 to 26.2.5.17, 27.0 to 27.3.4.8, 28.0 to 28.4.0.
Is there a fix for CVE-2026-23942?: A patch was published on 2026-03-13: Patches released in multiple OTP branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23942 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-23942?: Check whether you run Erlang/OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in the Erlang/OTP ssh_sftpd module due to improper path validation in the ssh_sftpd:is_within_root/2 routine. The server utilizes string prefix matching (lists:prefix/2) instead of proper path component validation when enforcing the 'root' directory restriction. An authenticated remote attacker can exploit this by requesting paths that share a string prefix with the configured root, such as accessing '/home/user1_private' when the root is set to '/home/user1'. This allows for unauthorized read and write access to sibling directories on the filesystem. The issue is resolved in OTP versions 28.4.1, 27.3.4.9, and 26.2.5.18.

Affected products

Erlang Erlang/OTP 17.0 to 26.2.5.17, 27.0 to 27.3.4.8, 28.0 to 28.4.0
Erlang ssh (Erlang module) 3.0.1 to 5.1.4.13, 5.2 to 5.2.11.5, 5.5 to 5.5.0

Timeline

2026-03-13: advisory: Initial disclosure by Erlang/OTP project
2026-03-13: patched: Patches released in multiple OTP branches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.