EUVD-2026-36056Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (EEF) · only source for this CVE.
CVSS VectorVendor: EEF
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery.
The SSH_FXP_READLINK handler in ssh_sftpd sends the raw result of file:read_link/2 to the client without calling chroot_filename/2 to strip the backend root prefix. An authenticated SFTP client can create a symlink inside the chroot pointing to /; ssh_sftpd resolves the target to the absolute backend root and stores it on disk. Reading the symlink back via SSH_FXP_READLINK returns that absolute path, for example /data/sftp, instead of the chrooted value /.
The information disclosed is the absolute filesystem path of the SFTP root directory and of any symlink targets within it. No file contents, credentials, or access to paths outside the root directory are obtainable through this issue alone.
This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.
This issue affects OTP from OTP 17.0 before 29.0.2, 28.5.0.2 and 27.3.4.13 corresponding to ssh from 3.0.1 before 6.0.1, 5.5.2.1 and 5.2.11.8.
AnalysisAI
Path disclosure in Erlang OTP's ssh_sftpd module exposes the absolute backend filesystem path of the SFTP chroot root to authenticated clients. By creating a symlink inside the chroot pointing to '/' and issuing SSH_FXP_READLINK, an authenticated SFTP client receives the raw absolute path (e.g., '/data/sftp') that the server uses as the chroot backend, rather than the sanitized chroot-relative value '/'. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; the CVSS 4.0 score of 2.3 reflects the narrowly scoped, low-severity nature of the disclosure.
Technical ContextAI
The vulnerability is in lib/ssh/src/ssh_sftpd.erl within the SSH_FXP_READLINK request handler of Erlang OTP's built-in SFTP subsystem (ssh application). When an SFTP server operates with a chroot root directory, symlink targets returned to the client must be processed through chroot_filename/2 to strip the backend root prefix before transmission - the same sanitization applied elsewhere in ssh_sftpd. The bug is a missing call: the SSH_FXP_READLINK code path returned the raw result of file:read_link/2 directly via ssh_xfer:xf_send_name without invoking chroot_filename/2 or canonicalize_filename. The fix (commit 8f4224a) inserts 'AbsTarget = filename:absname(NewPath, filename:dirname(AbsPath)), ChrootedPath = chroot_filename(canonicalize_filename(AbsTarget), State)' before sending the name. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) applies: the server inadvertently leaks internal infrastructure path details the client is not entitled to see. Affected products per CPE: cpe:2.3:a:erlang:otp:*:*:*:*:*:*:*:*.
RemediationAI
Upgrade Erlang OTP to one of the patched releases: 29.0.2 (ssh 6.0.1), 28.5.0.2 (ssh 5.5.2.1), or 27.3.4.13 (ssh 5.2.11.8). The upstream fix is available in commit 8f4224a0d2676b0653d2c71a889a956e8c2c62d6 on the erlang/otp repository (https://github.com/erlang/otp/commit/8f4224a0d2676b0653d2c71a889a956e8c2c62d6). Vendor advisory: https://github.com/erlang/otp/security/advisories/GHSA-pv7g-pjrq-x2fh. If immediate patching is not feasible, a targeted compensating control is to remove symlink-creation permissions for SFTP users within the chroot, which prevents the attack precondition from being established; the trade-off is that legitimate workflows relying on client-side symlink creation will break. A second option is to use a non-sensitive or opaque value as the chroot path (e.g., a UUID-named directory), reducing the intelligence value of the leaked path. Generic network-level controls cannot mitigate this issue as exploitation occurs over a valid, authenticated SFTP session.
Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation
An on-path attacker can force an Erlang/OTP TLS 1.2 or DTLS client to accept an anonymous cipher suite not offered by th
Denial of service in Erlang/OTP erts (inet_drv SCTP handler) lets unauthenticated remote attackers crash the BEAM VM by
Remote denial of service in Erlang/OTP's ssl application (dtls_packet_demux module) lets an unauthenticated attacker cra
Uncontrolled recursion in the Erlang/OTP ssl application when processing a crafted TLS/DTLS certificate chain allows rem
We need to output a JSON object based on the CVE-2026-59250 data. We must synthesize from multiple sources: description,
Authorization bypass in Erlang OTP's inets HTTP server allows unanauthenticated remote attackers to execute CGI scripts
Denial of service in the Erlang/OTP ssl application (OTP 22.2 through 29.0.3, and the 28.5.x/27.3.x maintenance branches
Erlang OTP public_key module (versions 1.16 through 1.20.3 and 1.17.1.2) fails to cryptographically verify OCSP responde
Authentication bypass in Erlang/OTP's TLS distribution module (inet_tls_dist) lets any attacker holding a TLS certificat
Credential leakage in Erlang/OTP's inets httpc client (versions 17.0 through 29.0.2, 28.5.0.2, and 27.3.4.13) allows att
A critical HTTP Request Smuggling vulnerability exists in Erlang OTP's inets httpd module that allows attackers to desyn
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today