SB2026051933 - IBM PowerVC update for Erlang OTP inets httpd

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026051933

SB2026051933 - IBM PowerVC update for Erlang OTP inets httpd

Published: May 19, 2026

Security Bulletin ID SB2026051933
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Path traversal (CVE-ID: CVE-2026-23942)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to access files outside the configured root directory.

The vulnerability exists due to path traversal in ssh_sftpd when validating file paths using string prefix matching for the root option. A remote user can request paths in sibling directories that share a common name prefix to access files outside the configured root directory.

The issue applies only when the root option is configured under the assumption that it provides complete directory isolation.


Remediation

Install update from vendor's website.

References