Executive brief
A security flaw in the Erlang/OTP SFTP server component can leak the actual folder paths on the host server to connected users. While the system is designed to hide the real server structure (chrooting), an authenticated user can discover the absolute path of the root directory, potentially revealing sensitive information like usernames or internal project names. This issue does not allow users to access files outside of their permitted area or modify data, but it provides internal system details that could be used to plan further attacks.
Technical details
The SSH_FXP_READLINK handler in the ssh_sftpd module fails to call chroot_filename/2 before returning the result of file:read_link/2 to the client. An authenticated attacker can create a symbolic link pointing to the root directory and then read it back to receive the absolute backend path (e.g., /data/sftp) instead of the expected chrooted path (/). This vulnerability only affects deployments where the 'root' option is configured for filesystem isolation. It allows for information disclosure regarding the host's directory structure and mount points but does not grant unauthorized file access or modification. Patches are available in OTP versions 29.0.2, 28.5.0.2, and 27.3.4.13.
Affected products
- Erlang OTP 17.0 before 29.0.2, 28.5.0.2, 27.3.4.13
- Erlang ssh 3.0.1 before 6.0.1, 5.5.2.1, 5.2.11.8
Timeline
- 2026-06-08: patched: Fix committed to Erlang/OTP repository
- 2026-06-10: disclosed: Public advisory published by Erlang Ecosystem Foundation