The Erlang OTP SSH daemon (ssh_sftpd module) mishandles user-supplied paths by storing the raw path rather than the resolved, chroot‑constrained path. When a file attribute change request (SSH_FXP_FSETSTAT) is processed, the daemon modifies the attributes of the real file on the host filesystem, bypassing the intended chroot boundary. This path traversal flaw is a classic “CWE‑22” weakness and allows an authenticated SFTP user to set permissions, ownership, or timestamps on arbitrary files that already exist on the host at the same relative path. File contents remain protected, but the ability to change attributes can be abused for privilege escalation if the daemon runs with elevated privileges.

The vulnerability affects Erlang OTP releases from 17.0 through 28.4.3, as well as the specific sub‑releases 27.3.4.11 and 26.2.5.20. It applies to versions of the SSH component in OTP 3.01 through 5.5.3, 5.2.11.7, and 5.1.4.15. Any system that installs one of these Erlang OTP releases and configures the SSH server to use the ‘root’ option for the SFTP subsystem is susceptible.

A remote attacker gains an SFTP session to an affected server that is configured with the root option. The exploit requires the target file to exist on the host at the same relative path; no content read or write is possible. If the SSH daemon is running as root, the attacker can remap executable binaries, assign set‑uid bits, alter ownership of sensitive files, or make system configuration files world‑writable, effectively bypassing the chroot and escalating privileges. The CVSS score is 5.3, indicating a moderate severity. The EPSS score is < 1 %, suggesting a very low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the potential impact of privilege escalation warrants a timely response.