Erlang OTP ssh_sftpd ssh_sftpd.erl path traversal

Summaryinfo

A vulnerability has been found in Erlang OTP and classified as critical. The affected element is an unknown function in the library lib/ssh/src/ssh_sftpd.erl of the component ssh_sftpd. Performing a manipulation results in path traversal. This vulnerability is cataloged as CVE-2026-23942. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as critical has been found in Erlang OTP (the affected version unknown). This affects an unknown part in the library lib/ssh/src/ssh_sftpd.erl of the component ssh_sftpd. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality. The summary by CVE is:

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2. The SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root. This issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-23942 since 01/19/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 302365 (Linux Distros Unpatched Vulnerability : CVE-2026-23942), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (302365) and CERT Bund (WID-SEC-2026-0721). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• SUSE openSUSE
• Open Source Erlang/OTP

Productinfo

Vendor

• Erlang

Name

• OTP

Website

• Product: https://github.com/erlang/otp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion