Erlang OTP up to 29.0.3 SSH_FXP_REALPATH ssh_sftpd.erl read_link response discrepancy

Summaryinfo

A vulnerability described as problematic has been identified in Erlang OTP up to 29.0.3. Affected is the function read_link in the library lib/ssh/src/ssh_sftpd.erl of the component SSH_FXP_REALPATH Handler. Such manipulation leads to response discrepancy. This vulnerability is listed as CVE-2026-53422. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Erlang OTP up to 29.0.3. Affected by this issue is the function read_link in the library lib/ssh/src/ssh_sftpd.erl of the component SSH_FXP_REALPATH Handler. The manipulation with an unknown input leads to a response discrepancy vulnerability. Using CWE to declare the problem leads to CWE-204. The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. Impacted is confidentiality. CVE summarizes:

Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths. An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points. The vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4. This issue affects OTP from OTP 17.0 until OTP 29.0.3, 28.5.0.3, and 27.3.4.14 corresponding to ssh from 3.0.1 until 6.0.2, 5.5.2.2, and 5.2.11.9.

The weakness was presented by Mohamed Ali Ibnal Hajali. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-53422 since 06/09/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-41410). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Erlang

Name

• OTP

Version

• 3.0.0
• 3.0.1
• 5.2.11.0
• 5.2.11.1
• 5.2.11.2
• 5.2.11.3
• 5.2.11.4
• 5.2.11.5
• 5.2.11.6
• 5.2.11.7
• 5.2.11.8
• 5.2.11.9
• 5.5.2.0
• 5.5.2.1
• 5.5.2.2
• 6.0.0
• 6.0.1
• 6.0.2
• 17.0
• 27.3.4.0
• 27.3.4.1
• 27.3.4.2
• 27.3.4.3
• 27.3.4.4
• 27.3.4.5
• 27.3.4.6
• 27.3.4.7
• 27.3.4.8
• 27.3.4.9
• 27.3.4.10
• 27.3.4.11
• 27.3.4.12
• 27.3.4.13
• 27.3.4.14
• 28.5.0.0
• 28.5.0.1
• 28.5.0.2
• 28.5.0.3
• 29.0.0
• 29.0.1
• 29.0.2
• 29.0.3

Website

• Product: https://github.com/erlang/otp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion