Based on the updated description, the issue is an observable response discrepancy in Erlang OTP’s ssh_sftpd module. The SSH_FXP_REALPATH handler does not canonicalize paths, allowing an authenticated SFTP client to send a REALPATH request containing '..' components that bypass the configured SFTP root. The server then resolves the uncanonicalized path against the host filesystem, returning SSH_FXP_NAME when the target exists or SSH_FX_NO_SUCH_FILE when it does not. This creates a path‑existence oracle that lets an attacker determine whether arbitrary files or directories outside the configured root are present, without revealing file contents, credentials, or write capability. The information disclosed can facilitate later attacks when combined with other vulnerabilities.

Affected systems include Erlang/OTP releases from 17.0 up to 29.0.2 inclusive, plus the specific releases 28.5.0.3 and 27.3.4.14, and the corresponding ssh module versions from 3.0.1 through 6.0.2, including releases 5.5.2.2 and 5.2.11.9. Any Erlang/OTP installation that includes the ssh_sftpd component within these ranges is vulnerable.

The CVSS score of 2.3 denotes a low overall severity, and the EPSS of <1% indicates that exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated SFTP session, so an attacker must already have valid credentials. Once authenticated, the attacker can send repeated REALPATH requests to enumerate the host’s filesystem structure outside the SFTP root. The gathered data can be useful in planning further attacks.