Executive brief
A vulnerability in the Erlang SFTP daemon allows authenticated users to bypass directory restrictions (chroot) and modify file attributes on the host system. While attackers cannot read or change the actual content of files, they can change permissions, ownership, and timestamps of files outside their assigned folder. If the service is running with high privileges, this could allow an attacker to gain full control over the server by making sensitive system files writable or executable.
Technical details
A path traversal vulnerability (CWE-22) exists in the Erlang OTP ssh_sftpd module when the 'root' option is used for chrooting. The daemon incorrectly stores raw, user-supplied paths in file handles rather than resolved paths. When an authenticated user issues an SSH_FXP_FSETSTAT command on such a handle, the server applies attribute changes (permissions, ownership, timestamps) to the real filesystem path instead of the chroot-restricted path. This allows an attacker to modify attributes of any file on the host that shares a relative path with a file they can open within the chroot. If the Erlang VM is running as root, this can lead to privilege escalation via setuid bit manipulation or modification of system configuration files. The issue is fixed in OTP versions 28.4.3, 27.3.4.11, and 26.2.5.20.
Affected products
- Erlang OTP 17.0 to 26.2.5.19, 27.0 to 27.3.4.10, 28.0 to 28.4.2
- Erlang ssh 3.0.1 to 5.1.4.14, 5.2 to 5.2.11.6, 5.5 to 5.5.2
Timeline
- 2026-04-20: patched: Fix committed to Erlang/OTP repository.
- 2026-04-21: advisory: GHSA-28jg-mw9x-hpm5 published.
- 2026-04-21: disclosed: CVE-2026-32147 published.