The vulnerability in Erlang OTP's ssh_sftpd module allows an authenticated SFTP client to create a symbolic link pointing to the root of the underlying filesystem. When the client queries the link with SSH_FXP_READLINK, the server returns the absolute backend path instead of the chrooted value, revealing the SFTP root directory and any symlink targets. This flaw is an instance of CWE‑200 Information Exposure, exposing sensitive filesystem structure without providing access to file contents or credentials. The attacker can only glean absolute paths, which could aid in further reconnaissance, but cannot directly read or modify files.

Erlang OTP 17.0 up to but excluding 29.0.2, 28.5.0.2, and 27.3.4.13, as well as the associated ssh libraries 3.0.1 up to but excluding 6.0.1, 5.5.2.1, and 5.2.11.8, are vulnerable when configurable chroot roots are used and the SFTP service is exposed.

The CVSS score of 2.3 indicates low severity. Exploitation requires an authenticated SFTP client and relies on the server’s configured chroot root directory. Neither EPSS data nor CISA KEV listing suggests active exploitation in the wild. Attackers gain only file path information, which may aid in reconnaissance but does not directly compromise files or elevate privileges.