CVE-2026-48855: Erlang OTP SSH Path Disclosure via Symlink Enumeration

Technical summary

The ssh_sftpd module's SSH_FXP_READLINK handler fails to sanitize symlink targets through the chroot_filename/2 function before returning results to the client. When an authenticated attacker creates a symlink within the chroot pointing to /, the SFTP daemon resolves it to the absolute backend root path, persists that path, and returns it unfiltered via SSH_FXP_READLINK. This direct path disclosure bypasses the intended chroot abstraction layer, leaking the actual mount point or root directory location (e.g., /data/sftp) to any authenticated user.

Business impact

The exposure is limited to filesystem path enumeration and does not provide file access or credential theft. However, detailed knowledge of backend filesystem layout increases reconnaissance value for attackers planning further attacks. Organizations relying on chroot obscurity for defense-in-depth or running multi-tenant SFTP environments may face information leakage that violates data classification or compliance policies. The impact is moderate unless the exposed paths reveal sensitive infrastructure details tied to other systems.

Affected systems

Erlang OTP versions 17.0 through versions before 27.3.4.13, 28.5.0.2, and 29.0.2 are affected. In terms of SSH module versions, this impacts ssh 3.0.1 through versions before 5.2.11.8, 5.5.2.1, and 6.0.1. Any deployment using vulnerable OTP or SSH library versions with SFTP enabled and relying on chroot for tenant isolation or path obscurity is in scope.

Exploitability

Exploitation requires valid SFTP credentials—no unauthenticated access is possible. The attack is straightforward: create a symlink inside the chroot, then read it back to obtain the absolute path. The CVSS 3.1 score of 6.5 (Medium) reflects authentication as a prerequisite and confidentiality impact without integrity or availability damage. No known public exploits are documented in the CISA KEV catalog. The low complexity and ease of reproduction once authenticated make this a practical post-compromise reconnaissance vector.

Remediation

Update to patched versions: OTP 29.0.2 or later, OTP 28.5.0.2, or OTP 27.3.4.13 and corresponding SSH module versions 6.0.1 or later, 5.5.2.1, or 5.2.11.8. Verify patch versions against Erlang OTP release notes and vendor advisories before deployment. Interim mitigations include restricting SFTP user populations, disabling symlink support if operationally feasible, or monitoring for suspicious symlink creation and SSH_FXP_READLINK queries on sensitive paths.

Patch guidance

Erlang OTP patches are distributed through the official Erlang Solutions repository and GitHub. Organizations should: (1) identify current OTP and SSH versions in production via erlang:system_info(otp_release) and ssh:module_info(attributes); (2) consult the Erlang OTP security advisory for precise version mappings and availability; (3) test patches in staging environments that replicate chroot and multi-tenant configurations; (4) schedule updates prioritizing systems with untrusted or high-privilege SFTP users; (5) verify successful patching by checking that symlink path resolution returns chrooted paths, not absolute backend paths.

Detection guidance

Monitor SFTP audit logs for: (1) creation of symlinks with targets pointing to / or .. sequences within chroot directories; (2) SSH_FXP_READLINK operations on recently created symlinks; (3) client parsing of absolute paths in SSH_FXP_NAME responses when chrooted paths are expected. Correlate SFTP activity logs with SSH server debug logs (if enabled at DEBUG level) to identify reconnaissance patterns. Inspect any symlinks lingering in SFTP directories post-incident, as they may serve as evidence of reconnaissance activity. Endpoint detection should flag unexpected readlink/symlink syscall sequences on SFTP root mount points.

Why prioritize this

This vulnerability merits medium-priority patching due to its pre-authentication requirement and limited direct impact. However, organizations with strict data classification rules, compliance frameworks (PCI-DSS, HIPAA) governing data residency, or multi-tenant SFTP services should elevate priority. The path disclosure can serve as a pivot point for lateral movement if the exposed filesystem layout reveals co-located services. Systems with public-facing SFTP and diverse user bases warrant faster patching than internal-only or single-tenant deployments.

Risk score, explained

The CVSS 3.1 base score of 6.5 (Medium) balances authenticated-only access (PR:L) against high confidentiality impact (C:H) with no integrity or availability harm. The score does not account for environmental factors such as multi-tenancy, compliance obligations, or downstream reconnaissance risk. Organizations should adjust the score upward if their threat model treats infrastructure path disclosure as a critical reconnaissance enabler or if compliance requirements prohibit any information leakage.

Frequently asked questions