CVE-2026-53422: Erlang OTP SSH SFTP Path Enumeration Vulnerability

Technical summary

The SSH_FXP_REALPATH handler in ssh_sftpd deviates from other SFTP operation handlers by calling relate_file_name/3 with the Canonicalize parameter set to false. This bypass prevents the is_within_root/2 check from properly resolving and validating .. path traversal components. The un-canonicalized path proceeds to resolve_symlinks/2, which traverses the filesystem above the configured SFTP root, issuing read_link() syscalls against arbitrary paths. An authenticated attacker crafts a REALPATH request containing traversal sequences that trigger different server responses: SSH_FXP_NAME when a target path exists, SSH_FX_NO_SUCH_FILE when it does not. This response discrepancy creates an oracle for enumerating filesystem paths outside the SFTP sandbox. The flaw resides in lib/ssh/src/ssh_sftpd.erl, specifically in the ssh_sftpd:handle_op/4 routine.

Business impact

This vulnerability enables authenticated SFTP users to map the host filesystem structure and identify the presence of sensitive files, directories, and mount points outside their authorized scope. While no file contents or credentials are exposed, the reconnaissance capability can inform secondary attacks, particularly in environments where SFTP access is provisioned to third parties, contractors, or untrusted tenant accounts. Organizations relying on SFTP root restrictions to segregate sensitive data may find those logical boundaries partially defeated. The impact is limited to information disclosure, but in multi-tenant or high-security environments, even path existence can constitute meaningful data leakage.

Affected systems

This vulnerability affects Erlang OTP versions prior to 29.0.3, specifically OTP 17.0 through 28.x and 27.x before their patched versions (OTP 28.5.0.3 and OTP 27.3.4.14 respectively). The corresponding Erlang SSH module versions affected are 3.0.1 through 6.0.1, 5.5.2.1, and 5.2.11.8. Any system running an affected OTP version with an active SFTP server (ssh_sftpd) exposed to authenticated users is at risk. This includes Erlang-based applications, services, or appliances that bundle OTP and expose SFTP access.

Exploitability

Exploitation requires a valid SFTP user account and network access to the SSH service. No authentication bypass or privilege escalation is needed; any authenticated SFTP session suffices. An attacker iteratively sends REALPATH requests with traversal paths targeting known or guessed locations and interprets response codes to confirm path existence. The attack is deterministic and leaves minimal forensic traces—each query appears as a normal SFTP operation. The simplicity and lack of special tools make exploitation accessible to anyone with basic SFTP knowledge and valid credentials. However, in well-monitored environments, repeated pattern-based path-testing queries may trigger anomaly detection.

Remediation

Upgrade to patched versions: OTP 29.0.3 or later, OTP 28.5.0.3, or OTP 27.3.4.14. These versions restore proper canonicalization in the REALPATH handler, ensuring .. components are resolved before the is_within_root/2 check, preventing traversal above the configured root. Organizations unable to patch immediately should restrict SFTP access to trusted accounts only, disable SFTP if not required, and monitor for suspicious REALPATH requests containing ../ sequences.

Patch guidance

The fix ensures that path canonicalization occurs before the root boundary check in the REALPATH handler, aligning it with other SFTP operation handlers. Verify the patched version against the Erlang OTP release notes and advisory documentation before deploying. Test SFTP functionality with chroot or root-restricted configurations post-patch to confirm proper confinement. A staged rollout approach is recommended for production environments running mission-critical Erlang services.

Detection guidance

Monitor SFTP logs for REALPATH requests containing .. path components, especially those with multiple directory traversal sequences. Baseline normal REALPATH usage in your environment and flag outliers. Analyze SSH debug logs at verbose levels for repeated path-resolution attempts targeting directories above the configured SFTP root. Intrusion detection systems can be tuned to flag SSH_FXP_REALPATH operations with suspicious path patterns. A more granular approach is to log all REALPATH invocations with their full request paths and response codes, enabling post-incident forensic analysis.

Why prioritize this

Although the CVSS score is moderate (4.3), this vulnerability warrants prioritization in environments where SFTP is externally facing or multi-tenant. The low barrier to exploitation (valid credentials only) combined with high information-disclosure value makes it attractive for reconnaissance. In regulated industries or systems handling sensitive intellectual property, path enumeration can facilitate subsequent attacks or compliance violations. Organizations with strong external SFTP presences or those provisioning SFTP access to third parties should prioritize patching.

Risk score, explained

CVSS 4.3 reflects the limited scope: authentication is required, no code execution or denial of service occurs, and only path existence (not contents) is disclosed. The attack vector is network-accessible, and the attack complexity is low. The confidentiality impact is rated low because the information leaked is binary path existence rather than data artifacts. Integrity and availability are unaffected. In contexts where path enumeration is highly sensitive (e.g., forensic/incident response systems, classified data repositories), the real-world risk may exceed the numeric score.

Frequently asked questions