SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured root
Severity and exploitation
KEV coverage does not rule out exploitation.
Assessment vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NSeverity
low2.3CVSS measures technical severity, not the likelihood of an attack.
Known exploitation
Not listed in the checked CISA KEV catalog
Absence from CISA KEV does not rule out attacks.
Public exploit
Not established by this record
Missing evidence does not mean no public exploit exists.
Remediation
Source guidance available
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
What this means
Erlang OTP's SFTP server has a vulnerability allowing authenticated users to enumerate files and directories outside the configured root directory. The issue affects OTP versions from 17.0 to 27.3.4.14, 28.5.0.3, and 29.0.3. An attacker can exploit this by sending a crafted REALPATH request, potentially gaining information to assist further attacks.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Attack conditions
No attack-condition excerpt has been identified here. Review the full source description and references for authentication, network access, and configuration requirements.
Review supporting sources →Affected versions
Check the exact model, release, and any platform requirements against your installation.
Erlang · EEF
OTP
1 range
Erlang · EEF
OTP
Package identity
pkg:software-id/erlang.org/otpIdentity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
17.0 → before *
otp versions
From 27.3.4.14: unaffected
From 28.5.0.3: unaffected
From 29.0.3: unaffected
Source order retained; this version scheme requires manual review.
Other versions: unknown
Product identifiers (CPE)
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*Erlang · EEF
OTP
1 range
Erlang · EEF
OTP
Package identity
pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.gitIdentity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
3.0.1 → before *
otp versions
From 5.2.11.9: unaffected
From 5.5.2.2: unaffected
From 6.0.2: unaffected
Source order retained; this version scheme requires manual review.
Other versions: unknown
Product identifiers (CPE)
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*Erlang · EEF
OTP
4 ranges
Erlang · EEF
OTP
Package identity
pkg:github/erlang/otpIdentity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
84adefa331c4159d432d22840663c38f155cd4c1 → before *
git versions
From 86622cfaacf57a02c7645d1999f946846b504c94: unaffected
From c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a: unaffected
From 059e5785ef8c1d423820ca633fb7b37f47645172: unaffected
Source order retained; this version scheme requires manual review.
unaffected
86622cfaacf57a02c7645d1999f946846b504c94 → before *
git versions
c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a → before *
git versions
059e5785ef8c1d423820ca633fb7b37f47645172 → before *
git versions
Other versions: unknown
Product identifiers (CPE)
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*What to do
Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.
- Use OS-level chroot to run the Erlang VM or SFTP server process in an isolated filesystem environment, eliminating reliance on the application-level root option.
- Ensure the SFTP server port on the machine running the Erlang/OTP SFTP server is not reachable from untrusted machines.
- Ensure that no sensitive information (usernames, project names, mount topology) is inferrable from the existence or non-existence of paths on the host filesystem.
cve.new guidance unless attributed to a publisher. This page does not inspect your installation.
Public exploit evidence
No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.
Original source description
Read the full publisher description
Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory.
The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths.
An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points.
The vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities.
This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.14, OTP 28.5.0.3, and OTP 29.0.3, corresponding to ssh from 3.0.1 before 5.2.11.9, 5.5.2.2, and 6.0.2. Whether OTP before OTP 17.0, corresponding to ssh before 3.0.1, is affected is unknown.
References
7 sourcesView 1 more references
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-53422View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
EEF · platform conditions
All conditions must hold
Any condition may hold
Vulnerable product
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*Before: 27.3.4.14
Vulnerable product
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*From (inclusive): 28.0
Before: 28.5.0.3
Vulnerable product
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*From (inclusive): 29.0
Before: 29.0.3
Applicability preview
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "27.3.4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "28.5.0.3",
"versionStartIncluding": "28.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "29.0.3",
"versionStartIncluding": "29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
]Contributing organizations · 2
Assigning organization
Additional data publisher
Timeline
All times UTCAdvisory published
Publication date supplied by the source.
Source updated
Latest modification date supplied by the source.
Last imported by cve.new
Latest catalog import, not the date we first saw this advisory.
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.