This vulnerability in Erlang OTP's ssh_sftpd module (specifically in ssh_sftpd:is_within_root/2) is due to improper limitation of a pathname to a restricted directory (CWE-22). The SFTP server incorrectly uses lists:prefix/2 for path validation, which only checks if the path string starts with the root directory string, rather than validating path components. Consequently, paths like /home/user10 or /home/user1_backup are incorrectly considered inside the root directory /home/user1, allowing authenticated users to access sibling directories. Affected OTP versions range from 17.0 through 28.4.1, including specific patch versions noted. The vulnerability has a CVSS 4.0 base score of 5.3, reflecting medium severity with network attack vector, low complexity, and low impact on confidentiality and integrity.

Authenticated users of the vulnerable Erlang OTP ssh_sftpd SFTP server can bypass directory restrictions and access files outside the intended root directory if those directories share a common prefix with the root. This could lead to unauthorized disclosure of files in sibling directories. The impact is limited by the requirement for authentication and the low confidentiality and integrity impact scores.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There are no patch links provided in the available data. Until an official fix is released, administrators should consider restricting user access or monitoring SFTP usage carefully to detect potential abuse of this path traversal issue. Avoid relying solely on string prefix matching for path validation in custom configurations.