Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.6

Erlang OTP SFTP server can access files outside its folder

CVE-2026-23942 · published 7 months ago
Summary

The SFTP component of Erlang/OTP does not correctly verify that a requested path is inside the configured directory, so a logged‑in user can reach sibling folders that share a name prefix. This could allow unwanted access to other users' files. Upgrade to the latest Erlang/OTP release or apply the vendor’s security patch to fix the path‑checking logic.

What to do
  • Update erlang otp to version 5.1.4.14.
  • Update erlang otp to version 26.2.5.18.
  • Update debian erlang to version 1:23.2.6+dfsg-1+deb11u4.
  • Update debian erlang to version 1:25.2.3+dfsg-1+deb12u4.
  • Update debian erlang to version 1:27.3.4.1+dfsg-1+deb13u2.
  • Update debian erlang to version 1:27.3.4.9+dfsg-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:11 debian erlang < 1:23.2.6+dfsg-1+deb11u4
Fix: upgrade to 1:23.2.6+dfsg-1+deb11u4
Debian:12 debian erlang < 1:25.2.3+dfsg-1+deb12u4
Fix: upgrade to 1:25.2.3+dfsg-1+deb12u4
Debian:13 debian erlang < 1:27.3.4.1+dfsg-1+deb13u2
Fix: upgrade to 1:27.3.4.1+dfsg-1+deb13u2
Debian:14 debian erlang < 1:27.3.4.9+dfsg-1
Fix: upgrade to 1:27.3.4.9+dfsg-1
Ubuntu:25.10 canonical erlang All versions
Ubuntu:26.04:LTS canonical erlang All versions
– erlang erlang\/otp >= 17.0, < 26.2.5.18
>= 27.0, < 27.3.4.9
>= 28.0, < 28.4.1
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
– erlang erlang\/ssh >= 3.0.1, < 5.1.4.14
>= 5.2, < 5.2.11.6
>= 5.5, <= 5.5.1
cpe:2.3:a:erlang:erlang\/ssh:*:*:*:*:*:*:*:*
Ubuntu:Pro:14.04:LTS canonical erlang All versions
Ubuntu:Pro:16.04:LTS canonical erlang All versions
Ubuntu:Pro:18.04:LTS canonical erlang All versions
Ubuntu:Pro:20.04:LTS canonical erlang All versions
Ubuntu:22.04:LTS canonical erlang All versions
Ubuntu:24.04:LTS canonical erlang All versions
– erlang otp < *
Fix: upgrade to 5.1.4.14
Original advisory text
SFTP root escape via component-agnostic prefix check in ssh_sftpd
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.

This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.

The SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.

This issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published13 Mar 2026
Updated4 Nov 2026
First seen15 Mar 2026
Sources
DEBIAN-CVE-2026-23942 · OSV
UBUNTU-CVE-2026-23942 · OSV
CVE-2026-23942 · OSV
CVE-2026-23942 · NVD
EEF-CVE-2026-23942 · OSV
GHSA-4749-w85x-hw9h · GHSA
CVE-2026-23942 · MITRE
Track software like this
Free during beta