Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-10T14:35:49 erlang: Erlang OTP ssh: Information disclosure via symlink resolution in SFTP 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CWE-59

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery. The SSH_FXP_READLINK handler in ssh_sftpd sends the raw result of file:read_link/2 to the client without calling chroot_filename/2 to strip the backend root prefix. An authenticated SFTP client can create a symlink inside the chroot pointing to /; ssh_sftpd resolves the target to the absolute backend root and stores it on disk. Reading the symlink back via SSH_FXP_READLINK returns that absolute path, for example /data/sftp, instead of the chrooted value /. The information disclosed is the absolute filesystem path of the SFTP root directory and of any symlink targets within it. No file contents, credentials, or access to paths outside the root directory are obtainable through this issue alone. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to ssh from 3.0.1 before 6.0.1, 5.5.2.1 and 5.2.11.8.

A flaw was found in Erlang OTP ssh, specifically within the `ssh_sftpd` module. An authenticated SFTP client can exploit this vulnerability by creating a symbolic link (symlink) inside a restricted directory (chroot) that points to the root directory. When the client reads this symlink, the `ssh_sftpd` module incorrectly reveals the absolute filesystem path of the SFTP root directory and any symlink targets, rather than the expected restricted path. This exposure of sensitive information allows for file discovery, but does not grant access to file contents, credentials, or paths outside the root directory.

Red Hat OpenStack Platform 16.2 Fix deferred erlang Red Hat OpenStack Platform 17.1 Fix deferred erlang Red Hat OpenStack Platform 18.0 Fix deferred erlang https://www.cve.org/CVERecord?id=CVE-2026-48855 https://nvd.nist.gov/vuln/detail/CVE-2026-48855 https://cna.erlef.org/cves/CVE-2026-48855.html https://github.com/erlang/otp/commit/8f4224a0d2676b0653d2c71a889a956e8c2c62d6 https://github.com/erlang/otp/security/advisories/GHSA-pv7g-pjrq-x2fh https://osv.dev/vulnerability/EEF-CVE-2026-48855 https://www.erlang.org/doc/system/versions.html#order-of-versions