The SFTP server in Erlang OTP validates file paths simply by checking if the requested path string starts with the configured root directory using lists:prefix/2. This approach does not perform full component-wise path resolution, so a user may specify a path that shares a common name prefix with the root directory. For example, when the root is set to "/home/user1", paths such as "/home/user10" or "/home/user1_backup" are mistakenly considered to lie within the root. This flaw allows an authenticated SFTP client to read, modify, or delete files outside the intended directory, thereby compromising confidentiality, integrity, and potentially availability of the host filesystem.

The vulnerability affects Erlang/OTP releases from OTP 17.0 through OTP 28.4.1, and specific builds 27.3.4.9 and 26.2.5.18. Corresponding ssh module versions that contain the flaw range from ssh 3.0.1 through 5.5.1, 5.2.11.6, and 5.1.4.14. Systems running these OTP or ssh releases with an exposed SFTP service for authenticated users are vulnerable.

Based on the description, it is inferred that the attacker must first authenticate to the SFTP service. The weakness permits traversal to sibling directories that share a name prefix, effectively escaping the configured root. The CVSS score is 5.3 (medium), the EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog, indicating a low but tangible risk. While the exploitation does not require additional privileges beyond SFTP authentication, the potential for unauthorized file access makes this a significant concern for multi‑tenant or shared environments. The likely attack vector is a local SFTP connection from a trusted or compromised client that supplies malicious path names.