The vulnerability arises because the SSH_FXP_REALPATH handler in the ssh_sftpd module calls relate_file_name/3 with Canonicalize=false, unlike other SFTP handlers. This allows '..' path components to bypass the is_within_root/2 check without resolution, enabling traversal above the configured root directory. The un-canonicalized path is then processed by resolve_symlinks/2, which performs read_link() syscalls on arbitrary filesystem paths. An authenticated SFTP client can exploit this by sending a crafted REALPATH request and observe different server responses (SSH_FXP_NAME if the path exists, SSH_FX_NO_SUCH_FILE if it does not), creating an oracle to enumerate filesystem structure outside the root. The vulnerability only reveals existence information, not file contents or credentials, but this information could aid further attacks. Affected versions include Erlang OTP from 17.0 before 29.0.3, 28.5.0.3, and 27.3.4.14, and ssh from 3.0.1 before 6.0.2, 5.5.2.2, and 5.2.11.9.

An authenticated SFTP user can enumerate the existence of files and directories outside the configured root directory on the server. This information disclosure does not include file contents, credentials, or write access. The leaked path existence information may assist attackers in planning further attacks by revealing sensitive filesystem structure details.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, limit SFTP user privileges and monitor for suspicious SFTP activity. Since the vulnerability requires authentication, controlling access to SFTP accounts reduces risk.