CVE-2026-23942

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23942
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2. The SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root. This issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cna.erlef.org/cves/CVE-2026-23942.html Vendor Advisory
https://github.com/erlang/otp/commit/27688a824f753d4c16371dc70e88753fb410590b Patch
https://github.com/erlang/otp/commit/5ed603a1211b83b8be2d1fc06d3f3bf30c3c9759 Patch
https://github.com/erlang/otp/commit/9e0ac85d3485e7898e0da88a14be0ee2310a3b28 Patch
https://github.com/erlang/otp/security/advisories/GHSA-4749-w85x-hw9h Mitigation Vendor Advisory
https://osv.dev/vulnerability/EEF-CVE-2026-23942 Vendor Advisory
https://www.erlang.org/doc/system/versions.html#order-of-versions Product
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/ssh:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/ssh:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/ssh:*:*:*:*:*:*:*:*
History

21 May 2026, 15:22

Type Values Removed Values Added
References () https://cna.erlef.org/cves/CVE-2026-23942.html - () https://cna.erlef.org/cves/CVE-2026-23942.html - Vendor Advisory
References () https://github.com/erlang/otp/commit/27688a824f753d4c16371dc70e88753fb410590b - () https://github.com/erlang/otp/commit/27688a824f753d4c16371dc70e88753fb410590b - Patch
References () https://github.com/erlang/otp/commit/5ed603a1211b83b8be2d1fc06d3f3bf30c3c9759 - () https://github.com/erlang/otp/commit/5ed603a1211b83b8be2d1fc06d3f3bf30c3c9759 - Patch
References () https://github.com/erlang/otp/commit/9e0ac85d3485e7898e0da88a14be0ee2310a3b28 - () https://github.com/erlang/otp/commit/9e0ac85d3485e7898e0da88a14be0ee2310a3b28 - Patch
References () https://github.com/erlang/otp/security/advisories/GHSA-4749-w85x-hw9h - () https://github.com/erlang/otp/security/advisories/GHSA-4749-w85x-hw9h - Mitigation, Vendor Advisory
References () https://osv.dev/vulnerability/EEF-CVE-2026-23942 - () https://osv.dev/vulnerability/EEF-CVE-2026-23942 - Vendor Advisory
References () https://www.erlang.org/doc/system/versions.html#order-of-versions - () https://www.erlang.org/doc/system/versions.html#order-of-versions - Product
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.4
CPE cpe:2.3:a:erlang:erlang\/ssh:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
First Time Erlang
Erlang erlang\/otp
Erlang erlang\/ssh

06 Apr 2026, 17:17

Type Values Removed Values Added
References
  • () https://cna.erlef.org/cves/CVE-2026-23942.html -
  • () https://osv.dev/vulnerability/EEF-CVE-2026-23942 -
Summary
  • (es) Limitación Inadecuada de un Nombre de Ruta a un Directorio Restringido ('Salto de Ruta') vulnerabilidad en Erlang OTP (módulo ssh_sftpd) permite Salto de Ruta. Esta vulnerabilidad está asociada con los archivos de programa lib/ssh/src/ssh_sftpd.erl y las rutinas de programa ssh_sftpd:is_within_root/2. El servidor SFTP utiliza la coincidencia de prefijos de cadena a través de lists:prefix/2 en lugar de una validación adecuada de los componentes de la ruta al verificar si una ruta está dentro del directorio raíz configurado. Esto permite a los usuarios autenticados acceder a directorios hermanos que comparten un prefijo de nombre común con el directorio raíz configurado. Por ejemplo, si la raíz está configurada como /home/user1, rutas como /home/user10 o /home/user1_backup se considerarían incorrectamente dentro de la raíz. Este problema afecta a OTP desde OTP 17.0 hasta OTP 28.4.1, OTP 27.3.4.9 y OTP 26.2.5.18, lo que corresponde a ssh desde 3.0.1 hasta 5.5.1, 5.2.11.6 y 5.1.4.14.

13 Mar 2026, 19:54

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-13 19:54

Updated : 2026-05-21 15:22

NVD link : CVE-2026-23942

Mitre link : CVE-2026-23942

CVE.ORG link : CVE-2026-23942

JSON object : View

Products Affected

erlang

  • erlang\/ssh
  • erlang\/otp
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')