Junglewise Threat Intelligence

CVE-2026-48858: Erlang OTP SSRF in ftp_internal PASV handler

CVE-2026-48858 · Severity: info · CVSS 6.3 · Published 2026-06-10

Technologies: Erlang Inets, Erlang OTP. Vendors: Erlang.

Executive brief

A vulnerability exists in the Erlang/OTP FTP client library, which is used by developers to transfer files. A malicious or compromised FTP server can trick the client into connecting to a different internal server instead of the intended data channel. This could allow an attacker to read sensitive internal data, interact with cloud metadata services, or use the client to attack other systems on the network.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Erlang/OTP ftp_internal module's PASV handler. When operating in passive mode with IPv4 (the default configuration), the client extracts the IP address from the server's 227 response and connects to it without verifying that it matches the IP of the control connection. An attacker-controlled FTP server can provide an arbitrary IP and port, forcing the client to initiate a TCP connection to internal hosts or third-party targets. This can be used to exfiltrate data via read operations or perform FTP bounce attacks. The issue is fixed in OTP versions 29.0.2, 28.5.0.2, and 27.3.4.13.

Affected products

  • Erlang OTP 17.4 before 29.0.2, 28.5.0.2, 27.3.4.13
  • Erlang inets 5.10.4 before 7.0
  • Erlang ftp 1.0 before 1.2.6, 1.2.4.1, 1.2.3.1

Timeline

  • 2026-06-03: patched: Fix committed to Erlang/OTP repository
  • 2026-06-10: advisory: NVD and Erlang Ecosystem Foundation published advisory

References

Related threats