Junglewise Threat Intelligence

CVE-2026-23942: Erlang OTP path traversal in ssh_sftpd root directory validation

CVE-2026-23942 · Severity: medium · CVSS 5.4 · Published 2026-03-13

Technologies: Erlang/OTP. Vendors: Erlang.

Executive brief

A vulnerability in the Erlang/OTP SFTP server allows authenticated users to access files outside of their assigned home directory. This occurs because the server incorrectly validates folder names, allowing access to any directory that starts with the same name as the restricted root folder (for example, accessing 'user1_backup' when only 'user1' should be allowed). This could lead to unauthorized data exposure or modification if sensitive information is stored in adjacent directories on the same server.

Technical details

A path traversal vulnerability exists in the Erlang/OTP ssh_sftpd module due to improper path validation in the ssh_sftpd:is_within_root/2 routine. The server utilizes string prefix matching (lists:prefix/2) instead of proper path component validation when enforcing the 'root' directory restriction. An authenticated remote attacker can exploit this by requesting paths that share a string prefix with the configured root, such as accessing '/home/user1_private' when the root is set to '/home/user1'. This allows for unauthorized read and write access to sibling directories on the filesystem. The issue is resolved in OTP versions 28.4.1, 27.3.4.9, and 26.2.5.18.

Affected products

  • Erlang Erlang/OTP 17.0 to 26.2.5.17, 27.0 to 27.3.4.8, 28.0 to 28.4.0
  • Erlang ssh (Erlang module) 3.0.1 to 5.1.4.13, 5.2 to 5.2.11.5, 5.5 to 5.5.0

Timeline

  • 2026-03-13: advisory: Initial disclosure by Erlang/OTP project
  • 2026-03-13: patched: Patches released in multiple OTP branches

References

Related threats