The vulnerability in Erlang OTP ssh_sftpd module (CVE-2026-48855) involves the SSH_FXP_READLINK handler returning the absolute backend root path when reading symlinks, due to not calling chroot_filename/2 to strip the backend root prefix. An authenticated SFTP client can create a symlink inside the chroot pointing to the root directory (/), causing ssh_sftpd to resolve and store the absolute backend path. Reading this symlink returns the absolute path (e.g., /data/sftp) instead of the chrooted path (/). This leads to exposure of sensitive information about the absolute filesystem paths within the SFTP root directory. The vulnerability does not allow access to file contents, credentials, or paths outside the root directory. It affects OTP versions from 17.0 before 29.0.2, 28.5.0.2, and 27.3.4.13, and ssh versions from 3.0.1 before 6.0.1, 5.5.2.1, and 5.2.11.8.

The impact is limited to disclosure of absolute filesystem paths within the SFTP root directory to an authenticated SFTP client. No file contents, credentials, or unauthorized access outside the root directory are exposed by this vulnerability. This information disclosure could aid an attacker in understanding the server's directory structure but does not directly compromise data confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor Erlang OTP vendor advisories for updates. In the meantime, restrict SFTP client authentication to trusted users to limit exposure. No other specific mitigations are indicated by the available data.