{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32147", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-03-10T22:37:29.213Z", "datePublished": "2026-04-21T12:01:20.350Z", "dateUpdated": "2026-04-22T04:13:25.005Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["ssh_sftpd"], "packageName": "ssh", "packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/ssh_sftpd.erl"], "programRoutines": [{"name": "ssh_sftpd:do_open/4"}, {"name": "ssh_sftpd:handle_op/4"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "5.5.3", "status": "unaffected"}, {"at": "5.2.11.7", "status": "unaffected"}, {"at": "5.1.4.15", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "3.01", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["ssh_sftpd"], "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["lib/ssh/src/ssh_sftpd.erl"], "programRoutines": [{"name": "ssh_sftpd:do_open/4"}, {"name": "ssh_sftpd:handle_op/4"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "28.4.3", "status": "unaffected"}, {"at": "27.3.4.11", "status": "unaffected"}, {"at": "26.2.5.20", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp"}, {"changes": [{"at": "28c5d5a6c5f873dc701b597276271763e7d1c004", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "07b8f441ca711f9812fad9e9115bab3c3aa92f79", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The SFTP subsystem must be configured with the <tt>root</tt> option in <tt>ssh_sftpd:subsystem_spec/1</tt>. The <tt>root</tt> option is not set by default."}], "value": "The SFTP subsystem must be configured with the root option in ssh_sftpd:subsystem_spec/1. The root option is not set by default."}], "credits": [{"lang": "en", "type": "finder", "value": "John Downey"}, {"lang": "en", "type": "remediation developer", "value": "Micha\u0142 W\u0105sowski"}, {"lang": "en", "type": "remediation reviewer", "value": "Jakub Witczak"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP <tt>ssh</tt> (<tt>ssh_sftpd</tt> module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.<p>The SFTP daemon (<tt>ssh_sftpd</tt>) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When <tt>SSH_FXP_FSETSTAT</tt> is issued on such a handle, file attributes (permissions, ownership, timestamps) are modified on the real filesystem path, bypassing the root directory boundary entirely.</p><p>Any authenticated SFTP user on a server configured with the <tt>root</tt> option can modify file attributes of files outside the intended chroot boundary. The prerequisite is that a target file must exist on the real filesystem at the same relative path. Note that this vulnerability only allows modification of file attributes; file contents cannot be read or altered through this attack vector.</p><p>If the SSH daemon runs as <tt>root</tt>, this enables direct privilege escalation: an attacker can set the setuid bit on any binary, change ownership of sensitive files, or make system configuration world-writable.</p><p>This vulnerability is associated with program files <tt>lib/ssh/src/ssh_sftpd.erl</tt> and program routines <tt>ssh_sftpd:do_open/4</tt> and <tt>ssh_sftpd:handle_op/4</tt>.</p><p>This issue affects OTP from OTP 17.0 until OTP 28.4.3, 27.3.4.11, and 26.2.5.20 corresponding to <tt>ssh</tt> from 3.01 until 5.5.3, 5.2.11.7, and 5.1.4.15.</p>"}], "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.\n\nThe SFTP daemon (ssh_sftpd) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When SSH_FXP_FSETSTAT is issued on such a handle, file attributes (permissions, ownership, timestamps) are modified on the real filesystem path, bypassing the root directory boundary entirely.\n\nAny authenticated SFTP user on a server configured with the root option can modify file attributes of files outside the intended chroot boundary. The prerequisite is that a target file must exist on the real filesystem at the same relative path. Note that this vulnerability only allows modification of file attributes; file contents cannot be read or altered through this attack vector.\n\nIf the SSH daemon runs as root, this enables direct privilege escalation: an attacker can set the setuid bit on any binary, change ownership of sensitive files, or make system configuration world-writable.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:do_open/4 and ssh_sftpd:handle_op/4.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.3, 27.3.4.11, and 26.2.5.20 corresponding to ssh from 3.01 until 5.5.3, 5.2.11.7, and 5.1.4.15."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-04-22T04:13:25.005Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-28jg-mw9x-hpm5"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-32147.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32147"}, {"tags": ["x_version-scheme"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}, {"tags": ["patch"], "url": "https://github.com/erlang/otp/commit/28c5d5a6c5f873dc701b597276271763e7d1c004"}], "source": {"discovery": "EXTERNAL"}, "title": "SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<ul><li>Do not use the <tt>root</tt> option in <tt>ssh_sftpd:subsystem_spec/1</tt>, and instead rely on OS-level chroot or container isolation to confine SFTP users.</li><li>Ensure the Erlang VM is not running as a privileged OS user. Running the VM as an unprivileged user limits the impact of this vulnerability, since attribute modifications are constrained by that user's OS-level permissions.</li></ul>"}], "value": "* Do not use the root option in ssh_sftpd:subsystem_spec/1, and instead rely on OS-level chroot or container isolation to confine SFTP users.\n* Ensure the Erlang VM is not running as a privileged OS user. Running the VM as an unprivileged user limits the impact of this vulnerability, since attribute modifications are constrained by that user's OS-level permissions."}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-21T13:11:06.946869Z", "id": "CVE-2026-32147", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-21T13:11:40.325Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32147", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-21T13:11:06.946869Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-21T13:11:15.174Z"}}], "cna": {"title": "SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "John Downey"}, {"lang": "en", "type": "remediation developer", "value": "Micha\u0142 W\u0105sowski"}, {"lang": "en", "type": "remediation reviewer", "value": "Jakub Witczak"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["ssh_sftpd"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "5.5.3", "status": "unaffected"}, {"at": "5.2.11.7", "status": "unaffected"}, {"at": "5.1.4.15", "status": "unaffected"}], "version": "3.01", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "packageName": "ssh", "programFiles": ["src/ssh_sftpd.erl"], "defaultStatus": "unknown", "programRoutines": [{"name": "ssh_sftpd:do_open/4"}, {"name": "ssh_sftpd:handle_op/4"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["ssh_sftpd"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "28.4.3", "status": "unaffected"}, {"at": "27.3.4.11", "status": "unaffected"}, {"at": "26.2.5.20", "status": "unaffected"}], "version": "17.0", "lessThan": "*", "versionType": "otp"}, {"status": "affected", "changes": [{"at": "28c5d5a6c5f873dc701b597276271763e7d1c004", "status": "unaffected"}], "version": "07b8f441ca711f9812fad9e9115bab3c3aa92f79", "lessThan": "*", "versionType": "git"}], "packageURL": "pkg:github/erlang/otp", "packageName": "erlang/otp", "programFiles": ["lib/ssh/src/ssh_sftpd.erl"], "collectionURL": "https://github.com", "defaultStatus": "unknown", "programRoutines": [{"name": "ssh_sftpd:do_open/4"}, {"name": "ssh_sftpd:handle_op/4"}]}], "references": [{"url": "https://github.com/erlang/otp/security/advisories/GHSA-28jg-mw9x-hpm5", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-32147.html", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-32147", "tags": ["related"]}, {"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions", "tags": ["x_version-scheme"]}, {"url": "https://github.com/erlang/otp/commit/28c5d5a6c5f873dc701b597276271763e7d1c004", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "* Do not use the root option in ssh_sftpd:subsystem_spec/1, and instead rely on OS-level chroot or container isolation to confine SFTP users.\n* Ensure the Erlang VM is not running as a privileged OS user. Running the VM as an unprivileged user limits the impact of this vulnerability, since attribute modifications are constrained by that user's OS-level permissions.", "supportingMedia": [{"type": "text/html", "value": "<ul><li>Do not use the <tt>root</tt> option in <tt>ssh_sftpd:subsystem_spec/1</tt>, and instead rely on OS-level chroot or container isolation to confine SFTP users.</li><li>Ensure the Erlang VM is not running as a privileged OS user. Running the VM as an unprivileged user limits the impact of this vulnerability, since attribute modifications are constrained by that user's OS-level permissions.</li></ul>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.\n\nThe SFTP daemon (ssh_sftpd) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When SSH_FXP_FSETSTAT is issued on such a handle, file attributes (permissions, ownership, timestamps) are modified on the real filesystem path, bypassing the root directory boundary entirely.\n\nAny authenticated SFTP user on a server configured with the root option can modify file attributes of files outside the intended chroot boundary. The prerequisite is that a target file must exist on the real filesystem at the same relative path. Note that this vulnerability only allows modification of file attributes; file contents cannot be read or altered through this attack vector.\n\nIf the SSH daemon runs as root, this enables direct privilege escalation: an attacker can set the setuid bit on any binary, change ownership of sensitive files, or make system configuration world-writable.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:do_open/4 and ssh_sftpd:handle_op/4.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.3, 27.3.4.11, and 26.2.5.20 corresponding to ssh from 3.01 until 5.5.3, 5.2.11.7, and 5.1.4.15.", "supportingMedia": [{"type": "text/html", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP <tt>ssh</tt> (<tt>ssh_sftpd</tt> module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.<p>The SFTP daemon (<tt>ssh_sftpd</tt>) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When <tt>SSH_FXP_FSETSTAT</tt> is issued on such a handle, file attributes (permissions, ownership, timestamps) are modified on the real filesystem path, bypassing the root directory boundary entirely.</p><p>Any authenticated SFTP user on a server configured with the <tt>root</tt> option can modify file attributes of files outside the intended chroot boundary. The prerequisite is that a target file must exist on the real filesystem at the same relative path. Note that this vulnerability only allows modification of file attributes; file contents cannot be read or altered through this attack vector.</p><p>If the SSH daemon runs as <tt>root</tt>, this enables direct privilege escalation: an attacker can set the setuid bit on any binary, change ownership of sensitive files, or make system configuration world-writable.</p><p>This vulnerability is associated with program files <tt>lib/ssh/src/ssh_sftpd.erl</tt> and program routines <tt>ssh_sftpd:do_open/4</tt> and <tt>ssh_sftpd:handle_op/4</tt>.</p><p>This issue affects OTP from OTP 17.0 until OTP 28.4.3, 27.3.4.11, and 26.2.5.20 corresponding to <tt>ssh</tt> from 3.01 until 5.5.3, 5.2.11.7, and 5.1.4.15.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "configurations": [{"lang": "en", "value": "The SFTP subsystem must be configured with the root option in ssh_sftpd:subsystem_spec/1. The root option is not set by default.", "supportingMedia": [{"type": "text/html", "value": "The SFTP subsystem must be configured with the <tt>root</tt> option in <tt>ssh_sftpd:subsystem_spec/1</tt>. The <tt>root</tt> option is not set by default.", "base64": false}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-04-21T12:01:20.350Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32147", "state": "PUBLISHED", "dateUpdated": "2026-04-21T13:11:40.325Z", "dateReserved": "2026-03-10T22:37:29.213Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-04-21T12:01:20.350Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.\n\nThe SFTP daemon (ssh_sftpd) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When SSH_FXP_FSETSTAT is issued on such a handle, file attributes (permissions, ownership, timestamps) are modified on the real filesystem path, bypassing the root directory boundary entirely.\n\nAny authenticated SFTP user on a server configured with the root option can modify file attributes of files outside the intended chroot boundary. The prerequisite is that a target file must exist on the real filesystem at the same relative path. Note that this vulnerability only allows modification of file attributes; file contents cannot be read or altered through this attack vector.\n\nIf the SSH daemon runs as root, this enables direct privilege escalation: an attacker can set the setuid bit on any binary, change ownership of sensitive files, or make system configuration world-writable.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:do_open/4 and ssh_sftpd:handle_op/4.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.3, 27.3.4.11, and 26.2.5.20 corresponding to ssh from 3.01 until 5.5.3, 5.2.11.7, and 5.1.4.15."}], "id": "CVE-2026-32147", "lastModified": "2026-04-21T16:20:24.180", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}, "published": "2026-04-21T12:15:58.800", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-32147.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/commit/28c5d5a6c5f873dc701b597276271763e7d1c004"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/security/advisories/GHSA-28jg-mw9x-hpm5"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32147"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.01,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.5.3]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.2.11.7]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.1.4.15]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[17.0,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[28.4.3]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[27.3.4.11]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[26.2.5.20]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[07b8f441ca711f9812fad9e9115bab3c3aa92f79,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "[28c5d5a6c5f873dc701b597276271763e7d1c004]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "erlang\\/otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.01,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.5.3]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.2.11.7]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.1.4.15]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[17.0,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[28.4.3]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[27.3.4.11]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[26.2.5.20]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[07b8f441ca711f9812fad9e9115bab3c3aa92f79,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "[28c5d5a6c5f873dc701b597276271763e7d1c004]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}], "analysis": {"en": {"generated_at": "2026-04-21T23:03:56.184748+00:00", "value": {"mitigation_remediation": ["Rely on operating\u2011system level chroot or container isolation rather than the SSH root option \u2013 do not use the root option in ssh_sftpd:subsystem_spec/1.", "Run the Erlang virtual machine as an unprivileged OS user \u2013 a non\u2011privileged VM limits the damage that can be caused by modified file attributes.", "Upgrade Erlang OTP to the latest version that contains the SSH fsetstat patch; consult the Erlang project releases for a fixed build or apply the vendor\u2011supplied advisory to update the otp/ssh component."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation via File Attribute Modification"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Erlang OTP releases from 17.0 through 28.4.3, as well as the specific sub\u2011releases 27.3.4.11 and 26.2.5.20. It applies to versions of the SSH component in OTP 3.01 through 5.5.3, 5.2.11.7, and 5.1.4.15. Any system that installs one of these Erlang OTP releases and configures the SSH server to use the \u2018root\u2019 option for the SFTP subsystem is susceptible.", "description_and_impact": "The Erlang OTP SSH daemon (ssh_sftpd module) mishandles user-supplied paths by storing the raw path rather than the resolved, chroot\u2011constrained path. When a file attribute change request (SSH_FXP_FSETSTAT) is processed, the daemon modifies the attributes of the real file on the host filesystem, bypassing the intended chroot boundary. This path traversal flaw is a classic \u201cCWE\u201122\u201d weakness and allows an authenticated SFTP user to set permissions, ownership, or timestamps on arbitrary files that already exist on the host at the same relative path. File contents remain protected, but the ability to change attributes can be abused for privilege escalation if the daemon runs with elevated privileges.", "risk_and_exploitability": "A remote attacker gains an SFTP session to an affected server that is configured with the root option. The exploit requires the target file to exist on the host at the same relative path; no content read or write is possible. If the SSH daemon is running as root, the attacker can remap executable binaries, assign set\u2011uid bits, alter ownership of sensitive files, or make system configuration files world\u2011writable, effectively bypassing the chroot and escalating privileges. The CVSS score is 5.3, indicating a moderate severity. The EPSS score is < 1\u202f%, suggesting a very low current exploitation probability, and the vulnerability is not listed in CISA\u2019s KEV catalog. Nonetheless, the potential impact of privilege escalation warrants a timely response."}}}}, "created": "2026-04-21T17:15:25.104547+00:00", "updated": "2026-04-21T23:15:03.116784+00:00", "vendors": ["erlang", "erlang$PRODUCT$erlang\\/otp", "erlang$PRODUCT$otp"]}