SB2026070302 - Fedora 44 update for erlang

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026070302

SB2026070302 - Fedora 44 update for erlang

Published: July 3, 2026

Security Bulletin ID SB2026070302
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Information disclosure (CVE-ID: CVE-2026-48855)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the SSH_FXP_READLINK handler in ssh_sftpd when reading symlink targets. A remote user can create a symlink and read it back via SFTP to disclose sensitive information.

Only configurations that use the SFTP root option are affected. The issue discloses absolute backend filesystem paths for the configured SFTP root directory and symlink targets within it, but does not by itself provide file contents or access outside the configured root.


Remediation

Install update from vendor's website.

References