CVE-2026-23942

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23942", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-01-19T14:23:14.343Z", "datePublished": "2026-03-13T09:11:56.424Z", "dateUpdated": "2026-11-11T19:42:24.004Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["ssh_sftpd"], "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "programFiles": ["lib/ssh/src/ssh_sftpd.erl"], "programRoutines": [{"name": "ssh_sftpd:is_within_root/2"}], "vendor": "Erlang", "versions": [{"changes": [{"at": "26.2.5.18", "status": "unaffected"}, {"at": "27.3.4.9", "status": "unaffected"}, {"at": "28.4.1", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["ssh_sftpd"], "packageName": "ssh", "packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/ssh_sftpd.erl"], "programRoutines": [{"name": "ssh_sftpd:is_within_root/2"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "5.1.4.14", "status": "unaffected"}, {"at": "5.2.11.6", "status": "unaffected"}, {"at": "5.5.1", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "3.0.1", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["ssh_sftpd"], "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["lib/ssh/src/ssh_sftpd.erl"], "programRoutines": [{"name": "ssh_sftpd:is_within_root/2"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "5ed603a1211b83b8be2d1fc06d3f3bf30c3c9759", "status": "unaffected"}, {"at": "9e0ac85d3485e7898e0da88a14be0ee2310a3b28", "status": "unaffected"}, {"at": "27688a824f753d4c16371dc70e88753fb410590b", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "5ed603a1211b83b8be2d1fc06d3f3bf30c3c9759", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "9e0ac85d3485e7898e0da88a14be0ee2310a3b28", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "27688a824f753d4c16371dc70e88753fb410590b", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The SFTP subsystem must be enabled on the SSH server, the SSH port must be reachable by the attacker, and a root directory must be configured. This is the case when <code>ssh_sftpd</code> is included in the <code>subsystems</code> option with a <code>root</code> parameter and there exist sibling directories sharing the same name prefix as the root.</p>"}, {"base64": false, "type": "text/markdown", "value": "The SFTP subsystem must be enabled on the SSH server, the SSH port must be reachable by the attacker, and a root directory must be configured. This is the case when `ssh_sftpd` is included in the `subsystems` option with a `root` parameter and there exist sibling directories sharing the same name prefix as the root."}], "value": "The SFTP subsystem must be enabled on the SSH server, the SSH port must be reachable by the attacker, and a root directory must be configured. This is the case when ssh_sftpd is included in the subsystems option with a root parameter and there exist sibling directories sharing the same name prefix as the root."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.2.5.18", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "27.3.4.9", "versionStartIncluding": "27.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "28.4.1", "versionStartIncluding": "28.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Luigino Camastra / Aisle Research"}, {"lang": "en", "type": "remediation developer", "value": "Jakub Witczak"}, {"lang": "en", "type": "remediation reviewer", "value": "Micha\u0142 W\u0105sowski"}], "datePublic": "2026-03-13T09:11:56.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.</p>\n<p>This vulnerability is associated with program files <code>lib/ssh/src/ssh_sftpd.erl</code> and program routines <code>ssh_sftpd:is_within_root/2</code>.</p>\n<p>The SFTP server uses string prefix matching via <code>lists:prefix/2</code> rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to <code>/home/user1</code>, paths like <code>/home/user10</code> or <code>/home/user1_backup</code> would incorrectly be considered within the root.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;26.2.5.18, OTP&nbsp;27.3.4.9, and OTP&nbsp;28.4.1, corresponding to ssh from 3.0.1 before 5.1.4.14, 5.2.11.6, and 5.5.1. Whether OTP before OTP&nbsp;17.0, corresponding to ssh before 3.0.1, is affected is unknown.</p>"}, {"base64": false, "type": "text/markdown", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files `lib/ssh/src/ssh_sftpd.erl` and program routines `ssh_sftpd:is_within_root/2`.\n\nThe SFTP server uses string prefix matching via `lists:prefix/2` rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to `/home/user1`, paths like `/home/user10` or `/home/user1_backup` would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.18, OTP\u00a027.3.4.9, and OTP\u00a028.4.1, corresponding to ssh from 3.0.1 before 5.1.4.14, 5.2.11.6, and 5.5.1. Whether OTP before OTP\u00a017.0, corresponding to ssh before 3.0.1, is affected is unknown."}], "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.18, OTP\u00a027.3.4.9, and OTP\u00a028.4.1, corresponding to ssh from 3.0.1 before 5.1.4.14, 5.2.11.6, and 5.5.1. Whether OTP before OTP\u00a017.0, corresponding to ssh before 3.0.1, is affected is unknown."}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-11-11T19:42:24.004Z"}, "references": [{"name": "SFTP root escape via component-agnostic prefix check in `ssh_sftpd`", "tags": ["vendor-advisory", "related"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-4749-w85x-hw9h"}, {"name": "EEF CNA record for CVE-2026-23942", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-23942.html"}, {"name": "OSV record EEF-CVE-2026-23942", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-23942"}, {"name": "Erlang/OTP version ordering", "tags": ["x_version-scheme"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}, {"name": "Fix commit 5ed603a in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/5ed603a1211b83b8be2d1fc06d3f3bf30c3c9759"}, {"name": "Fix commit 9e0ac85 in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/9e0ac85d3485e7898e0da88a14be0ee2310a3b28"}, {"name": "Fix commit 27688a8 in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/27688a824f753d4c16371dc70e88753fb410590b"}], "source": {"discovery": "EXTERNAL"}, "title": "SFTP root escape via component-agnostic prefix check in ssh_sftpd", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<ul>\n<li>Use OS-level chroot to run the Erlang VM/SFTP server process in an isolated filesystem environment.</li>\n<li>Ensure that no sensitive or precious data is readable or writable by the OS user running the Erlang VM.</li>\n<li>Ensure that the SFTP server port is not reachable from untrusted machines.</li>\n<li>Use directory naming conventions that avoid common prefixes (e.g., <code>/home/users/alice/</code> instead of <code>/home/user1/</code>).</li>\n</ul>"}, {"base64": false, "type": "text/markdown", "value": "* Use OS-level chroot to run the Erlang VM/SFTP server process in an isolated filesystem environment.\n* Ensure that no sensitive or precious data is readable or writable by the OS user running the Erlang VM.\n* Ensure that the SFTP server port is not reachable from untrusted machines.\n* Use directory naming conventions that avoid common prefixes (e.g., `/home/users/alice/` instead of `/home/user1/`)."}], "value": "* Use OS-level chroot to run the Erlang VM/SFTP server process in an isolated filesystem environment.\n* Ensure that no sensitive or precious data is readable or writable by the OS user running the Erlang VM.\n* Ensure that the SFTP server port is not reachable from untrusted machines.\n* Use directory naming conventions that avoid common prefixes (e.g., /home/users/alice/ instead of /home/user1/)."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T16:02:31.222384Z", "id": "CVE-2026-23942", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T16:02:38.388Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23942", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T16:02:31.222384Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T16:02:34.677Z"}}], "cna": {"title": "SFTP root escape via component-agnostic prefix check in ssh_sftpd", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Luigino Camastra / Aisle Research"}, {"lang": "en", "type": "remediation developer", "value": "Jakub Witczak"}, {"lang": "en", "type": "remediation reviewer", "value": "Micha\u0142 W\u0105sowski"}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "vendor": "Erlang", "modules": ["ssh_sftpd"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "26.2.5.18", "status": "unaffected"}, {"at": "27.3.4.9", "status": "unaffected"}, {"at": "28.4.1", "status": "unaffected"}], "version": "17.0", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:software-id/erlang.org/otp", "packageName": "otp", "programFiles": ["lib/ssh/src/ssh_sftpd.erl"], "defaultStatus": "unknown", "programRoutines": [{"name": "ssh_sftpd:is_within_root/2"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["ssh_sftpd"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "5.1.4.14", "status": "unaffected"}, {"at": "5.2.11.6", "status": "unaffected"}, {"at": "5.5.1", "status": "unaffected"}], "version": "3.0.1", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "packageName": "ssh", "programFiles": ["src/ssh_sftpd.erl"], "defaultStatus": "unknown", "programRoutines": [{"name": "ssh_sftpd:is_within_root/2"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["ssh_sftpd"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "5ed603a1211b83b8be2d1fc06d3f3bf30c3c9759", "status": "unaffected"}, {"at": "9e0ac85d3485e7898e0da88a14be0ee2310a3b28", "status": "unaffected"}, {"at": "27688a824f753d4c16371dc70e88753fb410590b", "status": "unaffected"}], "version": "84adefa331c4159d432d22840663c38f155cd4c1", "lessThan": "*", "versionType": "git"}, {"status": "unaffected", "version": "5ed603a1211b83b8be2d1fc06d3f3bf30c3c9759", "lessThan": "*", "versionType": "git"}, {"status": "unaffected", "version": "9e0ac85d3485e7898e0da88a14be0ee2310a3b28", "lessThan": "*", "versionType": "git"}, {"status": "unaffected", "version": "27688a824f753d4c16371dc70e88753fb410590b", "lessThan": "*", "versionType": "git"}], "packageURL": "pkg:github/erlang/otp", "packageName": "erlang/otp", "programFiles": ["lib/ssh/src/ssh_sftpd.erl"], "collectionURL": "https://github.com", "defaultStatus": "unknown", "programRoutines": [{"name": "ssh_sftpd:is_within_root/2"}]}], "datePublic": "2026-03-13T09:11:56.000Z", "references": [{"url": "https://github.com/erlang/otp/security/advisories/GHSA-4749-w85x-hw9h", "name": "SFTP root escape via component-agnostic prefix check in `ssh_sftpd`", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-23942.html", "name": "EEF CNA record for CVE-2026-23942", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-23942", "name": "OSV record EEF-CVE-2026-23942", "tags": ["related"]}, {"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions", "name": "Erlang/OTP version ordering", "tags": ["x_version-scheme"]}, {"url": "https://github.com/erlang/otp/commit/5ed603a1211b83b8be2d1fc06d3f3bf30c3c9759", "name": "Fix commit 5ed603a in erlang/otp", "tags": ["patch"]}, {"url": "https://github.com/erlang/otp/commit/9e0ac85d3485e7898e0da88a14be0ee2310a3b28", "name": "Fix commit 9e0ac85 in erlang/otp", "tags": ["patch"]}, {"url": "https://github.com/erlang/otp/commit/27688a824f753d4c16371dc70e88753fb410590b", "name": "Fix commit 27688a8 in erlang/otp", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "* Use OS-level chroot to run the Erlang VM/SFTP server process in an isolated filesystem environment.\n* Ensure that no sensitive or precious data is readable or writable by the OS user running the Erlang VM.\n* Ensure that the SFTP server port is not reachable from untrusted machines.\n* Use directory naming conventions that avoid common prefixes (e.g., /home/users/alice/ instead of /home/user1/).", "supportingMedia": [{"type": "text/html", "value": "<ul>\n<li>Use OS-level chroot to run the Erlang VM/SFTP server process in an isolated filesystem environment.</li>\n<li>Ensure that no sensitive or precious data is readable or writable by the OS user running the Erlang VM.</li>\n<li>Ensure that the SFTP server port is not reachable from untrusted machines.</li>\n<li>Use directory naming conventions that avoid common prefixes (e.g., <code>/home/users/alice/</code> instead of <code>/home/user1/</code>).</li>\n</ul>", "base64": false}, {"type": "text/markdown", "value": "* Use OS-level chroot to run the Erlang VM/SFTP server process in an isolated filesystem environment.\n* Ensure that no sensitive or precious data is readable or writable by the OS user running the Erlang VM.\n* Ensure that the SFTP server port is not reachable from untrusted machines.\n* Use directory naming conventions that avoid common prefixes (e.g., `/home/users/alice/` instead of `/home/user1/`).", "base64": false}]}], "descriptions": [{"lang": "en", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.18, OTP\u00a027.3.4.9, and OTP\u00a028.4.1, corresponding to ssh from 3.0.1 before 5.1.4.14, 5.2.11.6, and 5.5.1. Whether OTP before OTP\u00a017.0, corresponding to ssh before 3.0.1, is affected is unknown.", "supportingMedia": [{"type": "text/html", "value": "<p>Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.</p>\n<p>This vulnerability is associated with program files <code>lib/ssh/src/ssh_sftpd.erl</code> and program routines <code>ssh_sftpd:is_within_root/2</code>.</p>\n<p>The SFTP server uses string prefix matching via <code>lists:prefix/2</code> rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to <code>/home/user1</code>, paths like <code>/home/user10</code> or <code>/home/user1_backup</code> would incorrectly be considered within the root.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;26.2.5.18, OTP&nbsp;27.3.4.9, and OTP&nbsp;28.4.1, corresponding to ssh from 3.0.1 before 5.1.4.14, 5.2.11.6, and 5.5.1. Whether OTP before OTP&nbsp;17.0, corresponding to ssh before 3.0.1, is affected is unknown.</p>", "base64": false}, {"type": "text/markdown", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files `lib/ssh/src/ssh_sftpd.erl` and program routines `ssh_sftpd:is_within_root/2`.\n\nThe SFTP server uses string prefix matching via `lists:prefix/2` rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to `/home/user1`, paths like `/home/user10` or `/home/user1_backup` would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.18, OTP\u00a027.3.4.9, and OTP\u00a028.4.1, corresponding to ssh from 3.0.1 before 5.1.4.14, 5.2.11.6, and 5.5.1. Whether OTP before OTP\u00a017.0, corresponding to ssh before 3.0.1, is affected is unknown.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory"}]}], "configurations": [{"lang": "en", "value": "The SFTP subsystem must be enabled on the SSH server, the SSH port must be reachable by the attacker, and a root directory must be configured. This is the case when ssh_sftpd is included in the subsystems option with a root parameter and there exist sibling directories sharing the same name prefix as the root.", "supportingMedia": [{"type": "text/html", "value": "<p>The SFTP subsystem must be enabled on the SSH server, the SSH port must be reachable by the attacker, and a root directory must be configured. This is the case when <code>ssh_sftpd</code> is included in the <code>subsystems</code> option with a <code>root</code> parameter and there exist sibling directories sharing the same name prefix as the root.</p>", "base64": false}, {"type": "text/markdown", "value": "The SFTP subsystem must be enabled on the SSH server, the SSH port must be reachable by the attacker, and a root directory must be configured. This is the case when `ssh_sftpd` is included in the `subsystems` option with a `root` parameter and there exist sibling directories sharing the same name prefix as the root.", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "26.2.5.18"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "27.3.4.9", "versionStartIncluding": "27.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "28.4.1", "versionStartIncluding": "28.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-11-11T19:42:24.004Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23942", "state": "PUBLISHED", "dateUpdated": "2026-11-11T19:42:24.004Z", "dateReserved": "2026-01-19T14:23:14.343Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-03-13T09:11:56.424Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["ssh_sftpd"], "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "programFiles": ["lib/ssh/src/ssh_sftpd.erl"], "programRoutines": [{"name": "ssh_sftpd:is_within_root/2"}], "vendor": "Erlang", "versions": [{"changes": [{"at": "26.2.5.18", "status": "unaffected"}, {"at": "27.3.4.9", "status": "unaffected"}, {"at": "28.4.1", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["ssh_sftpd"], "packageName": "ssh", "packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/ssh_sftpd.erl"], "programRoutines": [{"name": "ssh_sftpd:is_within_root/2"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "5.1.4.14", "status": "unaffected"}, {"at": "5.2.11.6", "status": "unaffected"}, {"at": "5.5.1", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "3.0.1", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["ssh_sftpd"], "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["lib/ssh/src/ssh_sftpd.erl"], "programRoutines": [{"name": "ssh_sftpd:is_within_root/2"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "5ed603a1211b83b8be2d1fc06d3f3bf30c3c9759", "status": "unaffected"}, {"at": "9e0ac85d3485e7898e0da88a14be0ee2310a3b28", "status": "unaffected"}, {"at": "27688a824f753d4c16371dc70e88753fb410590b", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "5ed603a1211b83b8be2d1fc06d3f3bf30c3c9759", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "9e0ac85d3485e7898e0da88a14be0ee2310a3b28", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "27688a824f753d4c16371dc70e88753fb410590b", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "6241E245-67D2-4FA6-83FE-4E9A4A07B3D1", "versionEndExcluding": "26.2.5.18", "versionStartIncluding": "17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "BE60BA92-431E-4DE3-A1C1-E8976E3A6BA7", "versionEndExcluding": "27.3.4.9", "versionStartIncluding": "27.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "B8D9E80B-CA20-423A-A1A8-DEBB99D82BDB", "versionEndExcluding": "28.4.1", "versionStartIncluding": "28.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/ssh:*:*:*:*:*:*:*:*", "matchCriteriaId": "24FD89BF-28BB-4432-9FDA-F0D84B5F716C", "versionEndExcluding": "5.1.4.14", "versionStartIncluding": "3.0.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/ssh:*:*:*:*:*:*:*:*", "matchCriteriaId": "C0BFA1FA-14CC-4A47-A6A3-2572BA686367", "versionEndExcluding": "5.2.11.6", "versionStartIncluding": "5.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/ssh:*:*:*:*:*:*:*:*", "matchCriteriaId": "0ABFC1FB-435C-414A-BF43-B119730E3DCE", "versionEndIncluding": "5.5.1", "versionStartIncluding": "5.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.18, OTP\u00a027.3.4.9, and OTP\u00a028.4.1, corresponding to ssh from 3.0.1 before 5.1.4.14, 5.2.11.6, and 5.5.1. Whether OTP before OTP\u00a017.0, corresponding to ssh before 3.0.1, is affected is unknown."}, {"lang": "es", "value": "Limitaci\u00f3n Inadecuada de un Nombre de Ruta a un Directorio Restringido ('Salto de Ruta') vulnerabilidad en Erlang OTP (m\u00f3dulo ssh_sftpd) permite Salto de Ruta.\n\nEsta vulnerabilidad est\u00e1 asociada con los archivos de programa lib/ssh/src/ssh_sftpd.erl y las rutinas de programa ssh_sftpd:is_within_root/2.\n\nEl servidor SFTP utiliza la coincidencia de prefijos de cadena a trav\u00e9s de lists:prefix/2 en lugar de una validaci\u00f3n adecuada de los componentes de la ruta al verificar si una ruta est\u00e1 dentro del directorio ra\u00edz configurado. Esto permite a los usuarios autenticados acceder a directorios hermanos que comparten un prefijo de nombre com\u00fan con el directorio ra\u00edz configurado. Por ejemplo, si la ra\u00edz est\u00e1 configurada como /home/user1, rutas como /home/user10 o /home/user1_backup se considerar\u00edan incorrectamente dentro de la ra\u00edz.\n\nEste problema afecta a OTP desde OTP 17.0 hasta OTP 28.4.1, OTP 27.3.4.9 y OTP 26.2.5.18, lo que corresponde a ssh desde 3.0.1 hasta 5.5.1, 5.2.11.6 y 5.1.4.14."}], "id": "CVE-2026-23942", "lastModified": "2026-11-11T20:17:08.177", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23942", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T16:02:31.222384Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:54:15.520", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Vendor Advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-23942.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/erlang/otp/commit/27688a824f753d4c16371dc70e88753fb410590b"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/erlang/otp/commit/5ed603a1211b83b8be2d1fc06d3f3bf30c3c9759"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/erlang/otp/commit/9e0ac85d3485e7898e0da88a14be0ee2310a3b28"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-4749-w85x-hw9h"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Vendor Advisory"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-23942"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Product"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "pkg:otp/ssh@3.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "erlang/otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "pkg:otp/ssh@3.0.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "17.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}], "created": "2026-03-16T09:37:50.116354+00:00", "updated": "2026-08-03T08:15:03.625313+00:00", "vendors": ["erlang", "erlang$PRODUCT$erlang/otp", "erlang$PRODUCT$otp"]}