This vulnerability in Erlang OTP's ssh_sftpd module (specifically in ssh_sftpd:is_within_root/2) is due to improper limitation of a pathname to a restricted directory (CWE-22). The SFTP server incorrectly uses lists:prefix/2 for path validation, which treats directories with similar prefixes as within the root directory. For example, if the root is /home/user1, paths like /home/user10 or /home/user1_backup are mistakenly allowed, enabling path traversal to sibling directories. Affected versions include OTP 17.0 through 28.4.1, OTP 27.3.4.9, and OTP 26.2.5.18, corresponding to ssh versions 3.0.1 through 5.5.1 and certain patch versions.

Authenticated users of the vulnerable Erlang OTP ssh_sftpd SFTP server can access files outside the intended root directory by exploiting the path traversal flaw. This may lead to unauthorized disclosure of files in sibling directories that share a prefix with the root directory. The vulnerability does not require user interaction and has low attack complexity but requires low privileges. There is no indication of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Erlang's official advisories for updates. Until a fix is available, restrict access to the SFTP service to trusted users only and consider additional access controls to limit exposure.