The Erlang OTP SSH daemon (ssh_sftpd module) has a path‑traversal vulnerability that enables an authenticated SFTP user to modify file attributes outside of a configured chroot directory. The daemon stores raw, user‑supplied paths unmodified in file handles, so when an SSH_FXP_FSETSTAT request is issued the file attributes of the real filesystem path are changed, circumventing the chroot boundary. Only the file attributes—permissions, ownership, and timestamps—can be altered; file contents remain inaccessible. If the SSH daemon runs with root privilege, this flaw permits privilege escalation by setting the set‑uid bit on binaries, changing ownership of sensitive files, or making system configuration files world‑writable.

The vulnerability affects Erlang OTP releases from 17.0 through 28.4.3, as well as the specific sub‑releases 27.3.4.11 and 26.2.5.20. It applies to versions of the SSH component in OTP 3.01 through 5.5.3, 5.2.11.7, and 5.1.4.15. Any system that installs one of these Erlang OTP releases and configures the SSH server to use the ‘root’ option for the SFTP subsystem is susceptible.

A remote attacker gains an SFTP session to an affected server that is configured with the root option. The exploit requires the target file to exist on the host at the same relative path; no content read or write is possible. If the SSH daemon is running as root, the attacker can remap executable binaries, assign set‑uid bits, alter ownership of sensitive files, or make system configuration files world‑writable, effectively bypassing the chroot and escalating privileges. The CVSS score is 5.3, indicating a moderate severity. The EPSS score is < 1 %, suggesting a very low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the potential impact of privilege escalation warrants a timely response.