CVE-2026-53422

Name of the Vulnerable Software and Affected Versions Erlang OTP versions 17.0 through 29.0.3 Erlang OTP versions 17.0 through 28.5.0.3 Erlang OTP versions 17.0 through 27.3.4.14

Description An observable response discrepancy in the ssh sftpd module allows an authenticated SFTP user to enumerate files and directories outside the configured root directory. The SSH FXP REALPATH handler calls relate file name/3 with Canonicalize=false, which allows path traversal components to bypass the is within root/2 check. The path then enters resolve symlinks/2, which performs read link() syscalls on arbitrary filesystem paths. An attacker can use a crafted traversal path in a REALPATH request to create a path-existence oracle, as the server returns SSH FXP NAME if the path exists and SSH FX NO SUCH FILE if it does not. This issue is associated with the file lib/ssh/src/ssh sftpd.erl and the function ssh sftpd:handle op/4. This flaw only leaks the existence of paths and does not provide access to file contents or credentials.

Recommendations Update Erlang OTP to a version newer than 29.0.3, 28.5.0.3, and 27.3.4.14. Use OS-level chroot to run the Erlang VM or SFTP server process in an isolated filesystem environment. Restrict access to the SFTP server port so it is not reachable from untrusted machines. Ensure that no sensitive information is inferrable from the existence or non-existence of paths on the host filesystem.