Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-02T16:06:03 erlang: ssh: Erlang OTP ssh: Information disclosure via SFTP REALPATH handler 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CWE-204

Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths. An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points. The vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4. This issue affects OTP from OTP 17.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssh from 3.0.1 before 6.0.2, 5.5.2.2 and 5.2.11.9.

A flaw was found in Erlang OTP's Secure Shell (SSH) component, specifically within the SSH File Transfer Protocol (SFTP) daemon's ssh_sftpd module. An authenticated SFTP user can exploit an observable response discrepancy in the REALPATH handler to enumerate the existence of files and directories outside their authorized root directory. This vulnerability allows an attacker to determine if specific paths exist on the server's file system, potentially revealing sensitive information about the system's structure. While this issue does not directly expose file contents or grant write access, the gathered information could be used to facilitate further attacks.

Red Hat Hardened Images 2026-07-06T00:00:00Z RHSA-2026:35998 erlang27-main-27.3.4.14-1.hum1 Red Hat Hardened Images Not affected openssh Red Hat OpenStack Platform 16.2 Fix deferred erlang Red Hat OpenStack Platform 17.1 Fix deferred erlang Red Hat OpenStack Platform 18.0 Fix deferred erlang https://www.cve.org/CVERecord?id=CVE-2026-53422 https://nvd.nist.gov/vuln/detail/CVE-2026-53422 https://cna.erlef.org/cves/CVE-2026-53422.html https://github.com/erlang/otp/commit/059e5785ef8c1d423820ca633fb7b37f47645172 https://github.com/erlang/otp/commit/86622cfaacf57a02c7645d1999f946846b504c94 https://github.com/erlang/otp/commit/c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a https://github.com/erlang/otp/security/advisories/GHSA-h9pw-h5w4-h976 https://osv.dev/vulnerability/EEF-CVE-2026-53422 https://www.erlang.org/doc/system/versions.html#order-of-versions