The vulnerability in Erlang OTP's ssh_sftpd module (specifically in ssh_sftpd:is_within_root/2) is due to improper limitation of a pathname to a restricted directory (CWE-22). The SFTP server incorrectly uses string prefix matching (lists:prefix/2) to verify if a requested path is within the configured root directory, rather than validating path components properly. This flaw allows authenticated users to access directories outside the intended root if those directories have names sharing a prefix with the root directory path. The issue affects OTP versions from 17.0 before 28.4.1, 27.3.4.9, and 26.2.5.18, and ssh versions from 3.0.1 before 5.5.1, 5.2.11.6, and 5.1.4.14.

Authenticated users can exploit this vulnerability to access sibling directories outside the intended root directory if those directories share a common prefix with the root path. This could lead to unauthorized access to files and directories that should be restricted, potentially exposing sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a fix is available, restrict access to the SFTP server to trusted users only and monitor for unusual access patterns related to directory traversal attempts.