CVE-2026-48858: Erlang OTP SSRF in ftp_internal PASV handler

CVE-2026-48858 · Severity: info · CVSS 6.3 · Published 2026-06-10

A vulnerability exists in the Erlang/OTP FTP client library, which is used by developers to transfer files. A malicious or compromised FTP server can trick the client into connecting to a different internal server instead of the intended data channel. This could allow an attacker to read sensitive internal data, interact with cloud metadata services, or use the client to attack other systems on the network.

Technologies: Erlang Inets, Erlang OTP. Vendors: Erlang.

Quick answers

Is CVE-2026-48858 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48858 being exploited in the wild.
How severe is CVE-2026-48858?
Informational severity, with a CVSS score of 6.3, published 10 June 2026.
Which products and versions are affected?
Erlang Inets 5.10.4 before 7.0; Erlang OTP 17.4 before 29.0.2, 28.5.0.2, 27.3.4.13.
Is there a fix for CVE-2026-48858?
A patch was published on 2026-06-03: Fix committed to Erlang/OTP repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48858 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48858?
Check whether you run Erlang Inets or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Erlang/OTP ftp_internal module's PASV handler. When operating in passive mode with IPv4 (the default configuration), the client extracts the IP address from the server's 227 response and connects to it without verifying that it matches the IP of the control connection. An attacker-controlled FTP server can provide an arbitrary IP and port, forcing the client to initiate a TCP connection to internal hosts or third-party targets. This can be used to exfiltrate data via read operations or perform FTP bounce attacks. The issue is fixed in OTP versions 29.0.2, 28.5.0.2, and 27.3.4.13.

Affected products

  • Erlang OTP 17.4 before 29.0.2, 28.5.0.2, 27.3.4.13
  • Erlang inets 5.10.4 before 7.0
  • Erlang ftp 1.0 before 1.2.6, 1.2.4.1, 1.2.3.1

Timeline

  • 2026-06-03: patched: Fix committed to Erlang/OTP repository
  • 2026-06-10: advisory: NVD and Erlang Ecosystem Foundation published advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.