The vulnerability in Erlang OTP ssh_sftpd module (CVE-2026-53422) is due to the SSH_FXP_REALPATH handler calling relate_file_name/3 with Canonicalize=false, unlike other SFTP handlers. This allows path traversal components (..) to bypass the is_within_root/2 check, enabling the server to resolve symlinks and read links outside the configured root directory. An authenticated SFTP client can send a crafted REALPATH request to determine if arbitrary filesystem paths exist based on the server's response (SSH_FXP_NAME if the path exists, SSH_FX_NO_SUCH_FILE if not). This creates an oracle for filesystem enumeration outside the root directory. The vulnerability affects OTP versions from 17.0 through 29.0.3 and related ssh versions. No file content or write access is exposed by this issue alone.

An authenticated SFTP user can enumerate the existence of files and directories outside the configured root directory on the server. This information disclosure is limited to path existence and does not include file contents, credentials, or write access. The disclosed information could potentially aid further attacks when combined with other vulnerabilities. The overall impact is low severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor Erlang OTP vendor advisories for updates and consider restricting SFTP user privileges to minimize exposure until a fix is available.