SB2026042143 - Authenticated path traversal in Erlang OTP

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026042143

SB2026042143 - Authenticated path traversal in Erlang OTP

Published: April 21, 2026

Security Bulletin ID SB2026042143
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Path traversal (CVE-ID: CVE-2026-32147)

The vulnerability allows a remote user to modify file attributes outside the intended chroot boundary.

The vulnerability exists due to path traversal in the ssh_sftpd SFTP daemon when handling SSH_FXP_FSETSTAT on file handles created from user-supplied paths. A remote user can create a corresponding path inside the chroot and issue a crafted SSH_FXP_FSETSTAT request to modify file attributes outside the intended chroot boundary.

Only servers configured with the root option are vulnerable, and the target file must already exist on the real filesystem. File contents cannot be read or modified through this issue.


Remediation

Install update from vendor's website.

References