Key detail from vendor description: 'The SFTP server uses string prefix matching via lists:prefix/2 ...' because of this design an authenticated user can construct file names that share a common prefix with the configured root path, causing paths such as /home/user10 or /home/user1_backup to be incorrectly considered inside the root when the root is /home/user1. The resulting path traversal allows the attacker to read, write, or delete files outside the intended directory, thereby compromising confidentiality, integrity, and possibly availability of the filesystem.

The vulnerability affects Erlang/OTP releases from OTP 17.0 through OTP 28.4.1, and specific builds 27.3.4.9 and 26.2.5.18. Corresponding ssh module versions that contain the flaw range from ssh 3.0.1 through 5.5.1, 5.2.11.6, and 5.1.4.14. Systems running these OTP or ssh releases with an exposed SFTP service for authenticated users are vulnerable.

Based on the description, it is inferred that the attacker must first authenticate to the SFTP service. The weakness permits traversal to sibling directories that share a name prefix, effectively escaping the configured root. The CVSS score is 5.3 (medium), the EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog, indicating a low but tangible risk. While the exploitation does not require additional privileges beyond SFTP authentication, the potential for unauthorized file access makes this a significant concern for multi‑tenant or shared environments. The likely attack vector is a local SFTP connection from a trusted or compromised client that supplies malicious path names.