Is there a patch available for CVE-2026-53422?

Yes, a patch is available for CVE-2026-53422. Update the affected software to the latest version immediately.

Erlang OTP CVE-2026-53422

Q: What is the CVSS score of CVE-2026-53422?

CVE-2026-53422 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41410 LOW

Observable Response Discrepancy (CWE-204)

2026-07-02 EEF

Oracle Information Disclosure Otp

2.3

CVSS 4.0 · Vendor: EEF

Severity by source

Vendor (EEF) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-accessible SSH service requires authenticated SFTP credentials (PR:L); impact is strictly path-existence disclosure (C:L) with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (EEF).

CVSS VectorVendor: EEF

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 17:24 vuln.today

DescriptionCVE.org

Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory.

The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths.

An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points.

The vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities.

This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4.

This issue affects OTP from OTP 17.0 until OTP 29.0.3, 28.5.0.3, and 27.3.4.14 corresponding to ssh from 3.0.1 until 6.0.2, 5.5.2.2, and 5.2.11.9.

AnalysisAI

Path-traversal enumeration in Erlang OTP's ssh_sftpd module allows authenticated SFTP users to determine whether arbitrary filesystem paths exist outside the configured SFTP root directory. The SSH_FXP_REALPATH handler uniquely passes Canonicalize=false to relate_file_name/3, causing dotdot traversal sequences to skip the is_within_root/2 boundary check before entering resolve_symlinks/2, which then issues read_link() syscalls on arbitrary host paths. Affected versions span OTP 17.0 through the fixed releases 29.0.3, 28.5.0.3, and 27.3.4.14; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

The affected component is ssh_sftpd.erl in Erlang/OTP's built-in SSH daemon, specifically the handle_op/4 routine that processes SSH File Transfer Protocol (SFTP) operations. CWE-204 (Observable Response Discrepancy) is the root cause class: the server returns distinct response codes - SSH_FXP_NAME on success and SSH_FX_NO_SUCH_FILE on failure - revealing a boolean oracle about host filesystem paths. The inconsistency is architectural: every other SFTP operation handler invokes relate_file_name/3 with Canonicalize=true, which resolves dotdot components before the root-boundary check; only the SSH_FXP_REALPATH handler passes Canonicalize=false, leaving traversal components unresolved. Once the uncanonicalized path bypasses is_within_root/2, resolve_symlinks/2 walks symlink components upward beyond the jail. Affected CPE: cpe:2.3:a:erlang:otp covering OTP versions 17.0 through just before 27.3.4.14, 28.5.0.3, and 29.0.3, corresponding to ssh library versions 3.0.1 through just before 5.2.11.9, 5.5.2.2, and 6.0.2.

RemediationAI

The primary fix is upgrading Erlang OTP to one of the patched releases: OTP 29.0.3 (ssh 6.0.2), OTP 28.5.0.3 (ssh 5.5.2.2), or OTP 27.3.4.14 (ssh 5.2.11.9). Three upstream commits address the issue: 059e5785ef8c1d423820ca633fb7b37f47645172, 86622cfaacf57a02c7645d1999f946846b504c94, and c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a, available at the GitHub patch references. As a compensating control where patching is not immediately possible, operators can restrict SFTP access to only trusted, known-good user accounts, reducing the population of principals who can use the oracle. Additionally, disabling SSH_FXP_REALPATH handling in the sftpd configuration (if the application permits) eliminates the vulnerable code path entirely, though this may break SFTP client compatibility. Network-layer controls that limit which IP ranges can authenticate to the SFTP server reduce exposure but do not eliminate the vulnerability for trusted network segments. The advisory is at https://github.com/erlang/otp/security/advisories/GHSA-h9pw-h5w4-h976.