CVE-2026-53422 - Vulnerability Details

- SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured root

Description

Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory.

The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths.

An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points.

The vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities.

This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4.

This issue affects OTP from OTP 17.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssh from 3.0.1 before 6.0.2, 5.5.2.2 and 5.2.11.9.

Published: 2026-07-02

Score: 2.3 Low

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The issue is an observable response discrepancy in the SSH_FXP_REALPATH handler of Erlang OTP's ssh_sftpd module. Because the handler does not canonicalize paths, an authenticated SFTP client can send a REALPATH request containing .. components that bypass the SFTP root check and cause the server to resolve the uncanonicalized path against the host filesystem. The server replies with SSH_FXP_NAME if the target exists or SSH_FX_NO_SUCH_FILE if it does not. This creates a path‑existence oracle that allows an attacker to determine whether arbitrary files or directories outside the configured SFTP root are present, but does not reveal file contents, credentials, or write capability. The information disclosed can assist subsequent attacks when combined with other vulnerabilities.

Affected Systems

Affected systems include Erlang/OTP releases from 17.0 up to 29.0.3 (OTP 27.3..0.3 and 29.0.3) and the corresponding ssh module versions from 3.0.1 through 6.0.2, 5.5.2.2, and 5.2.11.9. Any Erlang/OTP installation that includes the ssh_sftpd component within these ranges is vulnerable.

Risk and Exploitability

The CVSS score of 2.3 denotes a low overall severity, and the EPSS of <1% indicates that exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated SFTP session, so an attacker must already have valid credentials. Once authenticated, the attacker can send repeated REALPATH requests to enumerate the host’s filesystem structure outside the SFTP root. the gathered data can be useful in planning further attacks.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Erlang

OTP

unaffected

Version	Status	Constraints
`3.0.1`	affected	< *

Erlang

OTP

unaffected

Version	Status	Constraints
`17.0`	affected	< *
`84adefa331c4159d432d22840663c38f155cd4c1`	affected	< *

No data.

Vendor Product Confidence Versions

Erlang

Erlang/otp

100%

Version	Status	Scheme	Platform
`[3.0.1,5.2.11.9)`	affected	generic	—
`[5.2.11.9,5.5.2.2)`	unaffected	generic	—
`[5.5.2.2,6.0.2)`	unaffected	generic	—
`[6.0.2,*]`	unaffected	generic	—
`[17.0,27.3.4.14)`	affected	generic	—
`[27.3.4.14,28.5.0.3)`	unaffected	generic	—
`[28.5.0.3,29.0.3)`	unaffected	generic	—
`[29.0.3,*]`	unaffected	generic	—
`[84adefa331c4159d432d22840663c38f155cd4c1,059e5785ef8c1d423820ca633fb7b37f47645172)`	affected	code_commit	—
`[059e5785ef8c1d423820ca633fb7b37f47645172,86622cfaacf57a02c7645d1999f946846b504c94)`	unaffected	code_commit	—
`[86622cfaacf57a02c7645d1999f946846b504c94,c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a)`	unaffected	code_commit	—
`[c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a,*]`	unaffected	code_commit	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`[3.0.1,5.2.11.9)`	affected	generic	—
`[5.2.11.9,5.5.2.2)`	unaffected	generic	—
`[5.5.2.2,6.0.2)`	unaffected	generic	—
`[6.0.2,*]`	unaffected	generic	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`[17.0,27.3.4.14)`	affected	generic	—
`[27.3.4.14,28.5.0.3)`	unaffected	generic	—
`[28.5.0.3,29.0.3)`	unaffected	generic	—
`[29.0.3,*]`	unaffected	generic	—
`[84adefa331c4159d432d22840663c38f155cd4c1,059e5785ef8c1d423820ca633fb7b37f47645172)`	affected	code_commit	—
`[059e5785ef8c1d423820ca633fb7b37f47645172,86622cfaacf57a02c7645d1999f946846b504c94)`	unaffected	code_commit	—
`[86622cfaacf57a02c7645d1999f946846b504c94,c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a)`	unaffected	code_commit	—
`[c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a,*]`	unaffected	code_commit	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

Vendor Workaround

* Use OS-level chroot to run the Erlang VM or SFTP server process in an isolated filesystem environment, eliminating reliance on the application-level root option. * Ensure the SFTP server port on the machine running the Erlang/OTP SFTP server is not reachable from untrusted machines. * Ensure that no sensitive information (usernames, project names, mount topology) is inferrable from the existence or non-existence of paths on the host filesystem.

OpenCVE Recommended Actions

Run the Erlang/OTP SFTP server inside an OS‑level chroot or other isolated filesystem environment to prevent access to the host filesystem outside the intended root.
Restrict the SFTP service port to bind only to trusted interfaces or employ firewall rules to block access from untrusted networks.
Ensure that the server does not reveal sensitive information through existence responses—do not disclose usernames, project names, or mount topology based on path existence feedback.

Generated by OpenCVE AI on July 24, 2026 at 11:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00262.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cna.erlef.org/cves/CVE-2026-53422.html
https://github.com/erlang/otp/commit/059e5785ef8c1d423820ca633fb7b37f47645172
https://github.com/erlang/otp/commit/86622cfaacf57a02c7645d1999f946846b504c94
https://github.com/erlang/otp/commit/c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a
https://github.com/erlang/otp/security/advisories/GHSA-h9pw-h5w4-h976
https://nvd.nist.gov/vuln/detail/CVE-2026-53422
https://osv.dev/vulnerability/EEF-CVE-2026-53422
https://www.cve.org/CVERecord?id=CVE-2026-53422
https://www.erlang.org/doc/system/versions.html#order-of-versions

History

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Description	Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths. An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points. The vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4. This issue affects OTP from OTP 17.0 until OTP 29.0.3, 28.5.0.3, and 27.3.4.14 corresponding to ssh from 3.0.1 until 6.0.2, 5.5.2.2, and 5.2.11.9.	Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths. An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points. The vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4. This issue affects OTP from OTP 17.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssh from 3.0.1 before 6.0.2, 5.5.2.2 and 5.2.11.9.

Thu, 09 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-53422 https://www.cve.org/CVERecord?id=CVE-2026-53422
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}` threat_severity `Moderate`

Thu, 02 Jul 2026 21:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Erlang erlang/otp Erlang otp
Vendors & Products		Erlang erlang/otp Erlang otp

Thu, 02 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 02 Jul 2026 16:45:00 +0000

Type	Values Removed	Values Added
Description		Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths. An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points. The vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4. This issue affects OTP from OTP 17.0 until OTP 29.0.3, 28.5.0.3, and 27.3.4.14 corresponding to ssh from 3.0.1 until 6.0.2, 5.5.2.2, and 5.2.11.9.
Title		SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured root
First Time appeared		Erlang Erlang erlang\/otp
Weaknesses		CWE-204
CPEs		cpe:2.3:a:erlang:erlang\/otp::::::::
Vendors & Products		Erlang Erlang erlang\/otp
References		https://cna.erlef.org/cves/CVE-2026-53422.html https://github.com/erlang/otp/commit/059e5785ef8c1d423820ca633fb7b37f47645172 https://github.com/erlang/otp/commit/86622cfaacf57a02c7645d1999f946846b504c94 https://github.com/erlang/otp/commit/c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a https://github.com/erlang/otp/security/advisories/GHSA-h9pw-h5w4-h976 https://osv.dev/vulnerability/EEF-CVE-2026-53422 https://www.erlang.org/doc/system/versions.html#order-of-versions
Metrics		cvssV4_0 `{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`

Subscriptions

Erlang Erlang/otp Erlang\/otp Otp

MITRE

Status: PUBLISHED

Assigner: EEF

Published: 2026-07-02T16:06:03.802Z

Updated: 2026-07-24T14:16:07.357Z

Reserved: 2026-06-09T11:01:47.529Z

Link: CVE-2026-53422

Vulnrichment

Updated: 2026-07-02T17:29:28.071Z

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-02T16:06:03Z

Links: CVE-2026-53422 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-24T11:45:03Z

Weaknesses

CWE-204
Observable Response Discrepancy

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object