CVE-2026-53422
SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured root
Description
Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths. An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points. The vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4. This issue affects OTP from OTP 17.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssh from 3.0.1 before 6.0.2, 5.5.2.2 and 5.2.11.9.
INFO
Published Date :
July 2, 2026, 5:17 p.m.
Last Modified :
July 24, 2026, 3:18 p.m.
Remotely Exploit :
Yes !
Source :
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Affected Products
The following products are affected by CVE-2026-53422
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 4.0 | LOW | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | ||||
| CVSS 4.0 | LOW | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db |
Solution
- Update Erlang OTP ssh to a patched version.
- Apply vendor-provided patches for ssh_sftpd.
- Restart the SSH service.
- Verify that the issue is resolved.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53422.
| URL | Resource |
|---|---|
| https://cna.erlef.org/cves/CVE-2026-53422.html | Mitigation Vendor Advisory |
| https://github.com/erlang/otp/commit/059e5785ef8c1d423820ca633fb7b37f47645172 | Patch |
| https://github.com/erlang/otp/commit/86622cfaacf57a02c7645d1999f946846b504c94 | Patch |
| https://github.com/erlang/otp/commit/c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a | Patch |
| https://github.com/erlang/otp/security/advisories/GHSA-h9pw-h5w4-h976 | Mitigation Vendor Advisory |
| https://osv.dev/vulnerability/EEF-CVE-2026-53422 | Mitigation Third Party Advisory |
| https://www.erlang.org/doc/system/versions.html#order-of-versions | Release Notes |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53422 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53422
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53422 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53422 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Jul. 24, 2026
Action Type Old Value New Value Changed Description Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths. An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points. The vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4. This issue affects OTP from OTP 17.0 until OTP 29.0.3, 28.5.0.3, and 27.3.4.14 corresponding to ssh from 3.0.1 until 6.0.2, 5.5.2.2, and 5.2.11.9. Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths. An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points. The vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4. This issue affects OTP from OTP 17.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssh from 3.0.1 before 6.0.2, 5.5.2.2 and 5.2.11.9. -
Initial Analysis by [email protected]
Jul. 07, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Added CPE Configuration OR *cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:* versions from (including) 17.0 up to (excluding) 27.3.4.14 *cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:* versions from (including) 28.0 up to (excluding) 28.5.0.3 *cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:* versions from (including) 29.0 up to (excluding) 29.0.3 *cpe:2.3:a:erlang:erlang/ssh:*:*:*:*:*:*:*:* versions from (including) 3.0.1 up to (excluding) 5.2.11.9 *cpe:2.3:a:erlang:erlang/ssh:*:*:*:*:*:*:*:* versions from (including) 5.3 up to (excluding) 5.5.2.2 *cpe:2.3:a:erlang:erlang/ssh:*:*:*:*:*:*:*:* versions from (including) 6.0 up to (excluding) 6.0.2 Added Reference Type EEF: https://cna.erlef.org/cves/CVE-2026-53422.html Types: Mitigation, Vendor Advisory Added Reference Type EEF: https://github.com/erlang/otp/commit/059e5785ef8c1d423820ca633fb7b37f47645172 Types: Patch Added Reference Type EEF: https://github.com/erlang/otp/commit/86622cfaacf57a02c7645d1999f946846b504c94 Types: Patch Added Reference Type EEF: https://github.com/erlang/otp/commit/c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a Types: Patch Added Reference Type EEF: https://github.com/erlang/otp/security/advisories/GHSA-h9pw-h5w4-h976 Types: Mitigation, Vendor Advisory Added Reference Type EEF: https://osv.dev/vulnerability/EEF-CVE-2026-53422 Types: Mitigation, Third Party Advisory Added Reference Type EEF: https://www.erlang.org/doc/system/versions.html#order-of-versions Types: Release Notes -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 02, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-53422', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-07-02T17:29:13.490797Z'} -
New CVE Received by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Jul. 02, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/erlang/otp', 'vendor': 'Erlang', 'modules': ['ssh_sftpd'], 'product': 'OTP', 'versions': [{'status': 'affected', 'changes': [{'at': '6.0.2', 'status': 'unaffected'}, {'at': '5.5.2.2', 'status': 'unaffected'}, {'at': '5.2.11.9', 'status': 'unaffected'}], 'version': '3.0.1', 'lessThan': '*', 'versionType': 'otp'}], 'packageURL': 'pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git', 'packageName': 'ssh', 'programFiles': ['src/ssh_sftpd.erl'], 'defaultStatus': 'unaffected', 'programRoutines': [{'name': 'ssh_sftpd:handle_op/4'}]}, {'cpes': ['cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/erlang/otp', 'vendor': 'Erlang', 'modules': ['ssh_sftpd'], 'product': 'OTP', 'versions': [{'status': 'affected', 'changes': [{'at': '29.0.3', 'status': 'unaffected'}, {'at': '28.5.0.3', 'status': 'unaffected'}, {'at': '27.3.4.14', 'status': 'unaffected'}], 'version': '17.0', 'lessThan': '*', 'versionType': 'otp'}, {'status': 'affected', 'changes': [{'at': '059e5785ef8c1d423820ca633fb7b37f47645172', 'status': 'unaffected'}, {'at': '86622cfaacf57a02c7645d1999f946846b504c94', 'status': 'unaffected'}, {'at': 'c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a', 'status': 'unaffected'}], 'version': '84adefa331c4159d432d22840663c38f155cd4c1', 'lessThan': '*', 'versionType': 'git'}], 'packageURL': 'pkg:github/erlang/otp', 'packageName': 'erlang/otp', 'programFiles': ['lib/ssh/src/ssh_sftpd.erl'], 'collectionURL': 'https://github.com', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': 'ssh_sftpd:handle_op/4'}]}] Added Description Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths. An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points. The vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4. This issue affects OTP from OTP 17.0 until OTP 29.0.3, 28.5.0.3, and 27.3.4.14 corresponding to ssh from 3.0.1 until 6.0.2, 5.5.2.2, and 5.2.11.9. Added CVSS V4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-204 Added Reference https://cna.erlef.org/cves/CVE-2026-53422.html Added Reference https://github.com/erlang/otp/commit/059e5785ef8c1d423820ca633fb7b37f47645172 Added Reference https://github.com/erlang/otp/commit/86622cfaacf57a02c7645d1999f946846b504c94 Added Reference https://github.com/erlang/otp/commit/c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a Added Reference https://github.com/erlang/otp/security/advisories/GHSA-h9pw-h5w4-h976 Added Reference https://osv.dev/vulnerability/EEF-CVE-2026-53422 Added Reference https://www.erlang.org/doc/system/versions.html#order-of-versions