CVE-2026-53422
SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured root
Description
Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths. An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points. The vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4. This issue affects OTP from OTP 17.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssh from 3.0.1 before 6.0.2, 5.5.2.2 and 5.2.11.9.
INFO
Published Date :
July 2, 2026, 5:17 p.m.
Last Modified :
Oct. 25, 2026, 9:10 p.m.
Remotely Exploit :
Yes !
Source :
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Affected Products
The following products are affected by CVE-2026-53422
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 4.0 | LOW | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | ||||
| CVSS 4.0 | LOW | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db |
Solution
- Update Erlang OTP ssh to a patched version.
- Apply vendor-provided patches for ssh_sftpd.
- Restart the SSH service.
- Verify that the issue is resolved.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53422.
| URL | Resource |
|---|---|
| https://cna.erlef.org/cves/CVE-2026-53422.html | Mitigation Vendor Advisory |
| https://github.com/erlang/otp/commit/059e5785ef8c1d423820ca633fb7b37f47645172 | Patch |
| https://github.com/erlang/otp/commit/86622cfaacf57a02c7645d1999f946846b504c94 | Patch |
| https://github.com/erlang/otp/commit/c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a | Patch |
| https://github.com/erlang/otp/security/advisories/GHSA-h9pw-h5w4-h976 | Mitigation Vendor Advisory |
| https://osv.dev/vulnerability/EEF-CVE-2026-53422 | Mitigation Third Party Advisory |
| https://www.erlang.org/doc/system/versions.html#order-of-versions | Release Notes |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53422 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53422
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53422 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53422 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 25, 2026
Action Type Old Value New Value Added Translation Title: OTP de Erlang, Description: Vulnerabilidad de Discrepancia de Respuesta Observable en Erlang OTP ssh (módulo ssh_sftpd) permite a un usuario SFTP autenticado enumerar la existencia de archivos y directorios fuera del directorio raíz configurado. El gestor SSH_FXP_REALPATH en ssh_sftpd llama a relate_file_name/3 con Canonicalize=false, a diferencia de cualquier otro gestor de operación SFTP. Esto permite que los componentes ’..’ en la ruta solicitada eludan la verificación is_within_root/2 sin ser resueltos. La ruta no canonizada luego entra en resolve_symlinks/2, que asciende por el árbol de directorios por encima de la raíz configurada y emite llamadas al sistema read_link() en rutas de sistema de archivos arbitrarias. Un cliente SFTP autenticado puede explotar esto enviando una solicitud REALPATH con una ruta de recorrido manipulada. La respuesta del servidor difiere dependiendo de si la ruta objetivo existe en el sistema de archivos del host (SSH_FXP_NAME cuando la ruta se resuelve con éxito, SSH_FX_NO_SUCH_FILE cuando no lo hace). Esto crea un oráculo de existencia de rutas que un atacante puede usar para enumerar la estructura del sistema de archivos fuera de la raíz configurada, incluyendo la existencia de archivos sensibles, directorios y puntos de montaje. La vulnerabilidad solo filtra la existencia de rutas. No se pueden obtener contenidos de archivos, credenciales o acceso de escritura a través de este problema por sí solo. La información obtenida puede ayudar a futuros ataques cuando se combina con otras vulnerabilidades. Esta vulnerabilidad está asociada con los archivos de programa lib/ssh/src/ssh_sftpd.erl y la rutina de programa ssh_sftpd:handle_op/4. Este problema afecta a OTP desde OTP 17.0 hasta OTP 29.0.3, 28.5.0.3 y 27.3.4.14 correspondiente a ssh desde 3.0.1 hasta 6.0.2, 5.5.2.2 y 5.2.11.9. -
CVE Modified by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Jul. 24, 2026
Action Type Old Value New Value Changed Description Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths. An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points. The vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4. This issue affects OTP from OTP 17.0 until OTP 29.0.3, 28.5.0.3, and 27.3.4.14 corresponding to ssh from 3.0.1 until 6.0.2, 5.5.2.2, and 5.2.11.9. Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths. An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points. The vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4. This issue affects OTP from OTP 17.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssh from 3.0.1 before 6.0.2, 5.5.2.2 and 5.2.11.9. -
Initial Analysis by [email protected]
Jul. 07, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Added CPE Configuration OR *cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:* versions from (including) 17.0 up to (excluding) 27.3.4.14 *cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:* versions from (including) 28.0 up to (excluding) 28.5.0.3 *cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:* versions from (including) 29.0 up to (excluding) 29.0.3 *cpe:2.3:a:erlang:erlang/ssh:*:*:*:*:*:*:*:* versions from (including) 3.0.1 up to (excluding) 5.2.11.9 *cpe:2.3:a:erlang:erlang/ssh:*:*:*:*:*:*:*:* versions from (including) 5.3 up to (excluding) 5.5.2.2 *cpe:2.3:a:erlang:erlang/ssh:*:*:*:*:*:*:*:* versions from (including) 6.0 up to (excluding) 6.0.2 Added Reference Type EEF: https://cna.erlef.org/cves/CVE-2026-53422.html Types: Mitigation, Vendor Advisory Added Reference Type EEF: https://github.com/erlang/otp/commit/059e5785ef8c1d423820ca633fb7b37f47645172 Types: Patch Added Reference Type EEF: https://github.com/erlang/otp/commit/86622cfaacf57a02c7645d1999f946846b504c94 Types: Patch Added Reference Type EEF: https://github.com/erlang/otp/commit/c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a Types: Patch Added Reference Type EEF: https://github.com/erlang/otp/security/advisories/GHSA-h9pw-h5w4-h976 Types: Mitigation, Vendor Advisory Added Reference Type EEF: https://osv.dev/vulnerability/EEF-CVE-2026-53422 Types: Mitigation, Third Party Advisory Added Reference Type EEF: https://www.erlang.org/doc/system/versions.html#order-of-versions Types: Release Notes -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 02, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-53422', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-07-02T17:29:13.490797Z'} -
New CVE Received by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Jul. 02, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/erlang/otp', 'vendor': 'Erlang', 'modules': ['ssh_sftpd'], 'product': 'OTP', 'versions': [{'status': 'affected', 'changes': [{'at': '6.0.2', 'status': 'unaffected'}, {'at': '5.5.2.2', 'status': 'unaffected'}, {'at': '5.2.11.9', 'status': 'unaffected'}], 'version': '3.0.1', 'lessThan': '*', 'versionType': 'otp'}], 'packageURL': 'pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git', 'packageName': 'ssh', 'programFiles': ['src/ssh_sftpd.erl'], 'defaultStatus': 'unaffected', 'programRoutines': [{'name': 'ssh_sftpd:handle_op/4'}]}, {'cpes': ['cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/erlang/otp', 'vendor': 'Erlang', 'modules': ['ssh_sftpd'], 'product': 'OTP', 'versions': [{'status': 'affected', 'changes': [{'at': '29.0.3', 'status': 'unaffected'}, {'at': '28.5.0.3', 'status': 'unaffected'}, {'at': '27.3.4.14', 'status': 'unaffected'}], 'version': '17.0', 'lessThan': '*', 'versionType': 'otp'}, {'status': 'affected', 'changes': [{'at': '059e5785ef8c1d423820ca633fb7b37f47645172', 'status': 'unaffected'}, {'at': '86622cfaacf57a02c7645d1999f946846b504c94', 'status': 'unaffected'}, {'at': 'c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a', 'status': 'unaffected'}], 'version': '84adefa331c4159d432d22840663c38f155cd4c1', 'lessThan': '*', 'versionType': 'git'}], 'packageURL': 'pkg:github/erlang/otp', 'packageName': 'erlang/otp', 'programFiles': ['lib/ssh/src/ssh_sftpd.erl'], 'collectionURL': 'https://github.com', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': 'ssh_sftpd:handle_op/4'}]}] Added Description Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths. An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points. The vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4. This issue affects OTP from OTP 17.0 until OTP 29.0.3, 28.5.0.3, and 27.3.4.14 corresponding to ssh from 3.0.1 until 6.0.2, 5.5.2.2, and 5.2.11.9. Added CVSS V4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-204 Added Reference https://cna.erlef.org/cves/CVE-2026-53422.html Added Reference https://github.com/erlang/otp/commit/059e5785ef8c1d423820ca633fb7b37f47645172 Added Reference https://github.com/erlang/otp/commit/86622cfaacf57a02c7645d1999f946846b504c94 Added Reference https://github.com/erlang/otp/commit/c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a Added Reference https://github.com/erlang/otp/security/advisories/GHSA-h9pw-h5w4-h976 Added Reference https://osv.dev/vulnerability/EEF-CVE-2026-53422 Added Reference https://www.erlang.org/doc/system/versions.html#order-of-versions