# CVE-2026-32147: Erlang OTP path traversal in ssh_sftpd module

Source: https://junglewise.ai/threats/cve-2026-32147-erlang-otp-path-traversal-in-ssh-sftpd-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-21. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-32147 · Severity: medium · CVSS 4.3 · Published 2026-04-21

A vulnerability in the Erlang SFTP daemon allows authenticated users to bypass directory restrictions (chroot) and modify file attributes on the host system. While attackers cannot read or change the actual content of files, they can change permissions, ownership, and timestamps of files outside their assigned folder. If the service is running with high privileges, this could allow an attacker to gain full control over the server by making sensitive system files writable or executable.

Technologies: [Erlang OTP](https://junglewise.ai/threats/technologies/otp). Vendors: [Erlang](https://junglewise.ai/threats/vendors/erlang).

## Quick answers

**Is CVE-2026-32147 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32147 being exploited in the wild.

**How severe is CVE-2026-32147?** Medium severity, with a CVSS score of 4.3, published 21 April 2026.

**Which products and versions are affected?** Erlang OTP 17.0 to 26.2.5.19, 27.0 to 27.3.4.10, 28.0 to 28.4.2.

**Is there a fix for CVE-2026-32147?** A patch was published on 2026-04-20: Fix committed to Erlang/OTP repository. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32147 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-32147?** Check whether you run Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in the Erlang OTP ssh_sftpd module when the 'root' option is used for chrooting. The daemon incorrectly stores raw, user-supplied paths in file handles rather than resolved paths. When an authenticated user issues an SSH_FXP_FSETSTAT command on such a handle, the server applies attribute changes (permissions, ownership, timestamps) to the real filesystem path instead of the chroot-restricted path. This allows an attacker to modify attributes of any file on the host that shares a relative path with a file they can open within the chroot. If the Erlang VM is running as root, this can lead to privilege escalation via setuid bit manipulation or modification of system configuration files. The issue is fixed in OTP versions 28.4.3, 27.3.4.11, and 26.2.5.20.

## Affected products

- Erlang OTP 17.0 to 26.2.5.19, 27.0 to 27.3.4.10, 28.0 to 28.4.2
- Erlang ssh 3.0.1 to 5.1.4.14, 5.2 to 5.2.11.6, 5.5 to 5.5.2

## Timeline

- 2026-04-20: patched: Fix committed to Erlang/OTP repository.
- 2026-04-21: advisory: GHSA-28jg-mw9x-hpm5 published.
- 2026-04-21: disclosed: CVE-2026-32147 published.

## References

- [https://cna.erlef.org/cves/CVE-2026-32147.html](https://cna.erlef.org/cves/CVE-2026-32147.html)
- [https://github.com/erlang/otp/commit/28c5d5a6c5f873dc701b597276271763e7d1c004](https://github.com/erlang/otp/commit/28c5d5a6c5f873dc701b597276271763e7d1c004)
- [https://github.com/erlang/otp/security/advisories/GHSA-28jg-mw9x-hpm5](https://github.com/erlang/otp/security/advisories/GHSA-28jg-mw9x-hpm5)
- [https://www.erlang.org/doc/system/versions.html](https://www.erlang.org/doc/system/versions.html)

## Related threats

- [Erlang OTP erl_tar infinite loop in GNU sparse member handling](https://junglewise.ai/threats/cve-2026-96596-loop-with-unreachable-exit-condition-infinite-loop-vulnerability)
- [Erlang OTP ssl denial of service in TLS 1.3 NewSessionTicket](https://junglewise.ai/threats/cve-2026-94200-improper-validation-of-consistency-within-input-vulnerability-in)
- [Erlang/OTP ssl TLS 1.3 server authentication bypass](https://junglewise.ai/threats/cve-2026-89422-key-exchange-without-entity-authentication-vulnerability-in)
- [Erlang/OTP SSH unbounded session channel allocation denial of service](https://junglewise.ai/threats/cve-2026-68956-allocation-of-resources-without-limits-or-throttling)
- [Erlang OTP asn1 OBJECT IDENTIFIER decoder algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-65634-inefficient-algorithmic-complexity-in-the-erlang-otp-asn1-object)