CVE-2026-48855 - Vulnerability Details

- SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery.

The SSH_FXP_READLINK handler in ssh_sftpd sends the raw result of file:read_link/2 to the client without calling chroot_filename/2 to strip the backend root prefix. An authenticated SFTP client can create a symlink inside the chroot pointing to /; ssh_sftpd resolves the target to the absolute backend root and stores it on disk. Reading the symlink back via SSH_FXP_READLINK returns that absolute path, for example /data/sftp, instead of the chrooted value /.

The information disclosed is the absolute filesystem path of the SFTP root directory and of any symlink targets within it. No file contents, credentials, or access to paths outside the root directory are obtainable through this issue alone.

This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to ssh from 3.0.1 before 6.0.1, 5.5.2.1 and 5.2.11.8.

Published: 2026-06-10

Score: 2.3 Low

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is an Exposure of Sensitive Information to an Unauthorized Actor in Erlang OTP’s ssh_sftpd module, allowing File Discovery. An authenticated SFTP client can create a symbolic link within the configured chroot that points to the backend root. When the server handles an SSH_FXP_READLINK request, it returns the absolute backend path rather than the chrooted value, revealing the full filesystem path of the SFTP root and any symlink targets. The disclosed information consists solely of absolute file system paths; no file contents, credentials, or paths outside the root can be accessed through this issue alone.

Affected Systems

Erlang OTP 17.0 up to but excluding 29.0.2, 28.5.0.2, and 27.3.4.13, as well as the associated ssh libraries 3.0.1 up to but excluding 6.0.1, 5.5.2.1, and 5.2.11.8, are vulnerable when configurable chroot roots are used and the SFTP service is exposed.

Risk and Exploitability

The CVSS score of 2.3 indicates low severity. Exploitation requires an authenticated SFTP client and relies on the server’s configured chroot root directory. Neither EPSS data nor CISA KEV listing suggests active exploitation in the wild. Attackers gain only file path information, which may aid in reconnaissance but does not directly compromise files or elevate privileges.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Erlang

OTP

unknown

Version	Status	Constraints
`3.0.1`	affected	< *

Erlang

OTP

unknown

Version	Status	Constraints
`17.0`	affected	< *
`08225797f7ef943d0c82a1d9dd6650d94ca2580d`	affected	< 8f4224a0d2676b0653d2c71a889a956e8c2c62d6

Configuration 1 [-]

OR	cpe:2.3:a:erlang:erlang\/otp::::::::
	cpe:2.3:a:erlang:erlang\/otp::::::::
	cpe:2.3:a:erlang:erlang\/otp::::::::
	cpe:2.3:a:erlang:erlang\/ssh::::::::
	cpe:2.3:a:erlang:erlang\/ssh::::::::
	cpe:2.3:a:erlang:erlang\/ssh::::::::

No data.

Vendor Product Confidence Versions

Erlang

Erlang/otp

95%

Version	Status	Scheme	Platform
`[3.0.1,*]`	affected	semver	—
`[17.0,*]`	affected	generic	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`[17.0,*]`	affected	generic	—
`[08225797f7ef943d0c82a1d9dd6650d94ca2580d,8f4224a0d2676b0653d2c71a889a956e8c2c62d6)`	affected	code_commit	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

Vendor Workaround

* Use OS-level chroot to run the Erlang VM/SFTP server process in an isolated filesystem environment, eliminating reliance on the application-level root option. * Ensure that the SFTP server port is not reachable from untrusted machines. * Ensure that no sensitive information (usernames, project names, mount topology) is inferrable from the absolute path of the configured root directory.

OpenCVE Recommended Actions

Upgrade Erlang OTP to version 29.0.2 or later, 28.5.0.2 or later, or 27.3.4.14 or later, which includes the fix.
Run the Erlang VM/SFTP server inside an OS-level chroot to isolate it from the actual filesystem.
Ensure the SFTP service is accessible only from trusted networks and avoid exposing sensitive path information to clients.

Generated by OpenCVE AI on August 3, 2026 at 07:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00277.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cna.erlef.org/cves/CVE-2026-48855.html
https://github.com/erlang/otp/commit/8f4224a0d2676b0653d2c71a889a956e8c2c62d6
https://github.com/erlang/otp/security/advisories/GHSA-pv7g-pjrq-x2fh
https://nvd.nist.gov/vuln/detail/CVE-2026-48855
https://osv.dev/vulnerability/EEF-CVE-2026-48855
https://www.cve.org/CVERecord?id=CVE-2026-48855
https://www.erlang.org/doc/system/versions.html#order-of-versions

History

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Description	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery. The SSH_FXP_READLINK handler in ssh_sftpd sends the raw result of file:read_link/2 to the client without calling chroot_filename/2 to strip the backend root prefix. An authenticated SFTP client can create a symlink inside the chroot pointing to /; ssh_sftpd resolves the target to the absolute backend root and stores it on disk. Reading the symlink back via SSH_FXP_READLINK returns that absolute path, for example /data/sftp, instead of the chrooted value /. The information disclosed is the absolute filesystem path of the SFTP root directory and of any symlink targets within it. No file contents, credentials, or access to paths outside the root directory are obtainable through this issue alone. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before 29.0.2, 28.5.0.2 and 27.3.4.13 corresponding to ssh from 3.0.1 before 6.0.1, 5.5.2.1 and 5.2.11.8.	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery. The SSH_FXP_READLINK handler in ssh_sftpd sends the raw result of file:read_link/2 to the client without calling chroot_filename/2 to strip the backend root prefix. An authenticated SFTP client can create a symlink inside the chroot pointing to /; ssh_sftpd resolves the target to the absolute backend root and stores it on disk. Reading the symlink back via SSH_FXP_READLINK returns that absolute path, for example /data/sftp, instead of the chrooted value /. The information disclosed is the absolute filesystem path of the SFTP root directory and of any symlink targets within it. No file contents, credentials, or access to paths outside the root directory are obtainable through this issue alone. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to ssh from 3.0.1 before 6.0.1, 5.5.2.1 and 5.2.11.8.

Mon, 15 Jun 2026 18:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Erlang erlang\/ssh
CPEs		cpe:2.3:a:erlang:erlang\/ssh::::::::
Vendors & Products		Erlang erlang\/ssh
Metrics	cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}`	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`

Sat, 13 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-59
References		https://nvd.nist.gov/vuln/detail/CVE-2026-48855 https://www.cve.org/CVERecord?id=CVE-2026-48855
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}` threat_severity `Moderate`

Wed, 10 Jun 2026 18:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Erlang erlang/otp Erlang otp
Vendors & Products		Erlang erlang/otp Erlang otp

Wed, 10 Jun 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 10 Jun 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery. The SSH_FXP_READLINK handler in ssh_sftpd sends the raw result of file:read_link/2 to the client without calling chroot_filename/2 to strip the backend root prefix. An authenticated SFTP client can create a symlink inside the chroot pointing to /; ssh_sftpd resolves the target to the absolute backend root and stores it on disk. Reading the symlink back via SSH_FXP_READLINK returns that absolute path, for example /data/sftp, instead of the chrooted value /. The information disclosed is the absolute filesystem path of the SFTP root directory and of any symlink targets within it. No file contents, credentials, or access to paths outside the root directory are obtainable through this issue alone. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before 29.0.2, 28.5.0.2 and 27.3.4.13 corresponding to ssh from 3.0.1 before 6.0.1, 5.5.2.1 and 5.2.11.8.
Title		SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured
First Time appeared		Erlang Erlang erlang\/otp
Weaknesses		CWE-200
CPEs		cpe:2.3:a:erlang:erlang\/otp::::::::
Vendors & Products		Erlang Erlang erlang\/otp
References		https://cna.erlef.org/cves/CVE-2026-48855.html https://github.com/erlang/otp/commit/8f4224a0d2676b0653d2c71a889a956e8c2c62d6 https://github.com/erlang/otp/security/advisories/GHSA-pv7g-pjrq-x2fh https://osv.dev/vulnerability/EEF-CVE-2026-48855 https://www.erlang.org/doc/system/versions.html#order-of-versions
Metrics		cvssV4_0 `{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`

Subscriptions

Erlang Erlang/otp Erlang\/otp Erlang\/ssh Otp

MITRE

Status: PUBLISHED

Assigner: EEF

Published: 2026-06-10T14:35:49.683Z

Updated: 2026-07-24T14:15:22.151Z

Reserved: 2026-05-25T20:44:10.697Z

Link: CVE-2026-48855

Vulnrichment

Updated: 2026-06-10T16:22:20.955Z

NVD

Status : Analyzed

Published: 2026-06-10T16:17:09.680

Modified: 2026-06-15T18:23:33.060

Link: CVE-2026-48855

Redhat

Severity : Moderate

Publid Date: 2026-06-10T14:35:49Z

Links: CVE-2026-48855 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-03T07:30:04Z

Weaknesses

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-59
Improper Link Resolution Before File Access ('Link Following')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object