Skip to main content

Erlang CVE-2026-23942

| EUVDEUVD-2026-11778 MEDIUM
Path Traversal (CWE-22)
2026-03-13 EEF
Path Traversal Otp Erlang
5.3
CVSS 4.0 · Vendor: EEF
View

Vulnerability Assessment

Weakness
CWE
CWE-22
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK

2 techniques across 2 tactics: Discovery, Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

The CVSS 4.0 score of 5.3 reflects low attack vector (network-accessible) and low attack complexity (no special conditions required), but critically requires PR:L (low privilege—an authenticated user account). The CVSS vector indicates low confidentiality impact and low integrity impact with no availability impact, suggesting data exfiltration or unauthorized file reading rather than system compromise. While the absolute CVSS score appears moderate, the real-world risk is elevated by several factors: the vulnerability requires authentication (reducing exposure), but once inside, an attacker gains directory traversal with minimal effort. The long affected version range (OTP 17.0 through 28.4.1) suggests a longstanding defect affecting many deployed systems. EPSS probability data was not provided, and no public proof-of-concept or KEV active-exploitation indicators were referenced, suggesting this is not yet a widespread attack vector. The practical impact depends on SFTP deployment scope and the sensitivity of data accessible via sibling directories, making this a priority for organizations using Erlang SFTP servers to manage sensitive file hierarchies.
Exploit ScenarioDerived

An authenticated user with SFTP access to a server configured with root directory /data/customer_prod connects via SFTP and attempts to access /data/customer_prod_staging by requesting the path in a LIST or GET command. The vulnerable is_within_root/2 function performs string prefix matching on the paths, finds that /data/customer_prod_staging begins with the prefix /data/customer_prod, and incorrectly allows the access. The attacker successfully reads sensitive staging environment files (configuration, test data, backup credentials) that should have been isolated from their authenticated session scope. No special exploitation tools are required beyond a standard SFTP client.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 13, 2026

The Erlang OTP ssh_sftpd module contains a path traversal vulnerability in the is_within_root/2 function that uses string prefix matching instead of proper path component validation to verify if accessed paths are within the configured root directory. An authenticated SFTP user can exploit this to access sibling directories sharing a common name prefix with the root directory (for example, if root is /home/user1, accessing /home/user10 or /home/user1_backup would succeed when it should fail). This vulnerability affects OTP versions 17.0 through 28.4.1 with corresponding SSH versions 3.0.1 through 5.5.1, with no confirmed active exploitation in the wild (KEV status not indicated as actively exploited) but with a moderate CVSS score of 5.3 reflecting the requirement for prior authentication.

RemediationAI

Immediately upgrade Erlang OTP to version 28.4.2 or later, OTP 27.3.4.10 or later (if remaining on the 27.x branch), or OTP 26.2.5.19 or later (if remaining on the 26.x branch); corresponding SSH application versions 5.5.2 or later are required. As an interim workaround pending patching, restrict SFTP server access to trusted networks only via firewall rules, disable SFTP functionality if not actively required, and audit configured root directories to ensure they do not share common prefixes with sensitive sibling paths (for example, avoid setting root to /home/user1 if /home/user10 contains sensitive data). Organizations should consult the official Erlang OTP security advisory for patch distribution channels and validation procedures.

Affected VersionsENISA

otp pkg:otp/ssh@3.0.1 <pkg:otp/ssh@*
otp 3.0.1 <*
otp 17.0 <*
otp 0 <*

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability exists in the SFTP server implementation within Erlang OTP, specifically in the ssh_sftpd module file lib/ssh/src/ssh_sftpd.erl. The ssh_sftpd:is_within_root/2 function is responsible for enforcing directory access controls by validating that user-requested file paths remain within an administrator-configured root directory. However, the implementation uses the Erlang lists:prefix/2 function to perform simple string-level prefix matching rather than canonical path parsing and component-level validation. This represents a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) vulnerability where path canonicalization and traversal-resistant validation is missing. The affected technology is the Secure File Transfer Protocol (SFTP) server component built into Erlang's SSH application, which is widely used in distributed Erlang systems and cloud infrastructure.

Know when Erlang gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (EEF) PRIMARY 5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE 5.4 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from Vendor (EEF).

CVSS VectorVendor: EEF

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Vulnerable system: Confidentiality
Low
Vulnerable system: Integrity
Low
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch released
Apr 06, 2026 - 17:17 nvd
Patch available
CVE Published
Mar 13, 2026 - 09:11 nvd
MEDIUM 5.3

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.

This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.

The SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.

This issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14.

Executive ViewAI

Why It Matters

CVE-2026-23942 presents moderate security risk, a path traversal vulnerability rated CVSS 5.3. This could allow unauthorized file access. A patch is available and should be applied during regular vulnerability management.

Business Impact: Low
Compensating Controls

Apply vendor patch. If patching is delayed: restrict file access via WAF, implement allowlists.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
Low

Priority Score

26
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +26
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Path Traversal HIGH

Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.

Related Vulnerabilities in Erlang OTP SSH Transport Flaws

View all 3
CVE-2026-23943 MEDIUM
6.9
CVE-2026-23941 HIGH
7.0

More in Erlang

View all
CVE-2025-32433 CRITICAL POC
10.0 Apr 16

Erlang/OTP SSH server allows unauthenticated remote code execution by exploiting a flaw in SSH protocol message handling
CVE-2017-1000385 MEDIUM POC
5.9 Dec 12

The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. Rat
CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
CVE-2020-13802 CRITICAL POC
9.8 Sep 02

Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specificat
CVE-2014-1693 HIGH POC
7.5 Dec 08

Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inje
CVE-2021-29221 HIGH POC
7.0 Apr 09

A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3. Rated high severity (CV
CVE-2016-10253 CRITICAL
9.8 Mar 18

An issue was discovered in Erlang/OTP 18.x. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
CVE-2022-37026 CRITICAL
9.8 Sep 21

In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in
CVE-2026-89422 CRITICAL
9.3 Sep 22

Erlang/OTP's ssl application in affected releases (OTP 22.2 through the fixed 27.3.4.18, 28.5.0.7 and 29.1.1) will compl
CVE-2026-67404 CRITICAL
9.2 Sep 23

RabbitMQ brokers that use the OAuth2 plugin can silently fall back to disabled TLS certificate verification when no CA b
CVE-2026-67231 CRITICAL
9.1 Sep 23

TLS client-authentication bypass in the RabbitMQ trust-store plugin lets a remote unauthenticated attacker whose forged

CVE-2026-55953 CRITICAL
9.1 Jul 27

An on-path attacker can force an Erlang/OTP TLS 1.2 or DTLS client to accept an anonymous cipher suite not offered by th

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://github.com/erlang/otp/commit/27688a824f753d4c16371dc70e88753fb410590b ADVISORY https://github.com/erlang/otp/commit/5ed603a1211b83b8be2d1fc06d3f3bf30c3c9759 ADVISORY https://github.com/erlang/otp/commit/9e0ac85d3485e7898e0da88a14be0ee2310a3b28 ADVISORY https://github.com/erlang/otp/security/advisories/GHSA-4749-w85x-hw9h ADVISORY https://vuldb.com/?id.350829 ADVISORY https://www.erlang.org/doc/system/versions.html#order-of-versions REF https://cna.erlef.org/cves/CVE-2026-23942.html REF https://osv.dev/vulnerability/EEF-CVE-2026-23942

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy