Erlang EUVD-2026-24085

Exploitation requires an authenticated SFTP user account on a server where (1) the ssh_sftpd module is configured with the root option to enforce a chroot directory, and (2) target files exist on the real filesystem at the same relative path as referenced in the SFTP client's requests (e.g., if chroot is /var/sftp and the attacker requests ../../etc/passwd, then /etc/passwd must exist on the real filesystem). The vulnerability is not exploitable against SFTP servers without the root option enabled, as chroot is not enforced. Exploitation is limited to modification of file metadata (permissions, ownership, timestamps); read/write access to file contents is not possible. If the SSH daemon runs as root, the attacker gains root-level capability to modify any file's attributes, enabling privilege escalation; if the SSH daemon runs as a non-root service account, attribute modifications are constrained by that account's filesystem permissions.

The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N) correctly reflects moderate real-world risk: network-accessible exploitation with low complexity, but requiring low-privilege authentication. The integrity impact is limited (VI:L/SI:L) because only file attributes, not contents, can be modified. However, this assessment does NOT fully capture the privilege escalation scenario described in the CVE: when the SSH daemon runs as root (a common hardened deployment pattern), an attacker can set setuid bits on binaries or change ownership of system files, enabling direct privilege escalation to root - effectively a high-impact vulnerability in that context. The limiting factor is the authentication requirement (PR:L): a valid SFTP user account is necessary. The lack of EPSS data and KEV status in the provided input means real-world exploitation frequency cannot be quantified; however, the simplicity of the attack (crafting SSH_FXP_FSETSTAT commands within an authenticated session) and the high impact when SSH daemon runs as root suggest this merits urgent patching despite the low CVSS number.

An authenticated SFTP user logs into an Erlang OTP SSH server configured with chroot=/var/sftp and the daemon running as root. The attacker executes SSH_FXP_OPEN on a relative path like "../../etc/passwd" to obtain a file handle. The handle internally stores the raw relative path. The attacker then issues SSH_FXP_FSETSTAT on that handle to set the mode to 0o666, modifying /etc/passwd permissions outside the chroot jail. Alternatively, the attacker can set the setuid bit on /usr/bin/sudo or change file ownership to gain root-level privilege escalation.