CVE-2026-48855: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in Erlang OTP
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery. The SSH_FXP_READLINK handler in ssh_sftpd sends the raw result of file:read_link/2 to the client without calling chroot_filename/2 to strip the backend root prefix. An authenticated SFTP client can create a symlink inside the chroot pointing to /; ssh_sftpd resolves the target to the absolute backend root and stores it on disk. Reading the symlink back via SSH_FXP_READLINK returns that absolute path, for example /data/sftp, instead of the chrooted value /. The information disclosed is the absolute filesystem path of the SFTP root directory and of any symlink targets within it. No file contents, credentials, or access to paths outside the root directory are obtainable through this issue alone. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to ssh from 3.0.1 before 6.0.1, 5.5.2.1 and 5.2.11.8.
AI Analysis
Technical Summary
The vulnerability in Erlang OTP ssh_sftpd (CVE-2026-48855) involves the SSH_FXP_READLINK handler sending the raw output of file:read_link/2 to the client without applying chroot_filename/2 to remove the backend root prefix. An authenticated SFTP client can create symlinks inside the chroot pointing to the root directory (/), causing ssh_sftpd to resolve and store the absolute backend path. When reading the symlink back, the client receives the absolute filesystem path (e.g., /data/sftp) instead of the chrooted path (/). This leaks the absolute path of the SFTP root and symlink targets but does not disclose file contents, credentials, or allow access outside the root directory. The issue affects Erlang OTP versions from 17.0 up to but not including OTP 29.0.2, OTP 28.5.0.2, and OTP 27.3.4.13, corresponding to ssh versions 3.0.1 up to but not including 6.0.1, 5.5.2.1, and 5.2.11.8.
Potential Impact
The vulnerability leaks absolute filesystem paths of the SFTP root directory and symlink targets to authenticated SFTP clients. This exposure of sensitive path information could aid attackers in reconnaissance but does not provide access to file contents, credentials, or paths outside the chrooted environment. The overall impact is limited to information disclosure of filesystem layout within the chroot.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Until a patch is available, limit SFTP client privileges and monitor for suspicious activity. Follow vendor updates for remediation.
CVE-2026-48855: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in Erlang OTP
Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery. The SSH_FXP_READLINK handler in ssh_sftpd sends the raw result of file:read_link/2 to the client without calling chroot_filename/2 to strip the backend root prefix. An authenticated SFTP client can create a symlink inside the chroot pointing to /; ssh_sftpd resolves the target to the absolute backend root and stores it on disk. Reading the symlink back via SSH_FXP_READLINK returns that absolute path, for example /data/sftp, instead of the chrooted value /. The information disclosed is the absolute filesystem path of the SFTP root directory and of any symlink targets within it. No file contents, credentials, or access to paths outside the root directory are obtainable through this issue alone. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to ssh from 3.0.1 before 6.0.1, 5.5.2.1 and 5.2.11.8.
CVSS v4.0
Score 2.3low
Affected software
pkg:github/erlang/otpcpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Erlang OTP ssh_sftpd (CVE-2026-48855) involves the SSH_FXP_READLINK handler sending the raw output of file:read_link/2 to the client without applying chroot_filename/2 to remove the backend root prefix. An authenticated SFTP client can create symlinks inside the chroot pointing to the root directory (/), causing ssh_sftpd to resolve and store the absolute backend path. When reading the symlink back, the client receives the absolute filesystem path (e.g., /data/sftp) instead of the chrooted path (/). This leaks the absolute path of the SFTP root and symlink targets but does not disclose file contents, credentials, or allow access outside the root directory. The issue affects Erlang OTP versions from 17.0 up to but not including OTP 29.0.2, OTP 28.5.0.2, and OTP 27.3.4.13, corresponding to ssh versions 3.0.1 up to but not including 6.0.1, 5.5.2.1, and 5.2.11.8.
Potential Impact
The vulnerability leaks absolute filesystem paths of the SFTP root directory and symlink targets to authenticated SFTP clients. This exposure of sensitive path information could aid attackers in reconnaissance but does not provide access to file contents, credentials, or paths outside the chrooted environment. The overall impact is limited to information disclosure of filesystem layout within the chroot.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Until a patch is available, limit SFTP client privileges and monitor for suspicious activity. Follow vendor updates for remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- EEF
- Date Reserved
- 2026-05-25T20:44:10.697Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a298ad7c9170919df36742c
Added to database: 06/10/2026, 16:03:35 UTC
Last enriched: 07/24/2026, 21:35:24 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 71
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.