Path traversal in Erlang OTP - CVE-2026-32147

Vulnerability identifier: #VU126652

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-32147

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to modify file attributes outside the intended chroot boundary.

The vulnerability exists due to path traversal in the ssh_sftpd SFTP daemon when handling SSH_FXP_FSETSTAT on file handles created from user-supplied paths. A remote user can create a corresponding path inside the chroot and issue a crafted SSH_FXP_FSETSTAT request to modify file attributes outside the intended chroot boundary.

Only servers configured with the root option are vulnerable, and the target file must already exist on the real filesystem. File contents cannot be read or modified through this issue.

Erlang OTP
SUSE Linux Enterprise Server 15 SP6
Debian Linux
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
Server Applications Module
openSUSE Leap
openEuler
PowerVC
erlang-et
erlang-diameter
erlang-doc
erlang-reltool-src
erlang-diameter-src
erlang-wx-src
erlang-wx
erlang-debugsource
erlang-dialyzer-debuginfo
erlang-observer
erlang
erlang-jinterface
erlang-jinterface-src
erlang-src
erlang-epmd
erlang-reltool
erlang-debugger
erlang-observer-src
erlang-dialyzer
erlang-epmd-debuginfo
erlang-wx-debuginfo
erlang-debugger-src
erlang-et-src
erlang-dialyzer-src
erlang-debuginfo
erlang-inets
erlang-ftp
erlang-examples
erlang-eunit
erlang-erts
erlang-erl_interface
erlang-erl_docgen
erlang-eldap
erlang-edoc
erlang-crypto
erlang-compiler
erlang-common_test
erlang-asn1
erlang-kernel
erlang-sasl
erlang-xmerl
erlang-tools
erlang-tftp
erlang-syntax_tools
erlang-stdlib
erlang-ssl
erlang-ssh
erlang-snmp
erlang-runtime_tools
erlang-public_key
erlang-parsetools
erlang-os_mon
erlang-odbc
erlang-mnesia
erlang-megaco
erlang26-dialyzer-src
erlang26-reltool
erlang26-et
erlang26-debugger
erlang26-dialyzer
erlang26-src
erlang26-jinterface-src
erlang26-dialyzer-debuginfo
erlang26-reltool-src
erlang26-debugger-src
erlang26-observer-src
erlang26-diameter
erlang26-et-src
erlang26-wx-debuginfo
erlang26-debuginfo
erlang26-debugsource
erlang26-doc
erlang26-epmd-debuginfo
erlang26-epmd
erlang26-jinterface
erlang26
erlang26-wx
erlang26-wx-src
erlang26-observer
erlang26-diameter-src
erlang (Debian package)

Install security update from vendor's website.

Erlang OTP - addressed in versions 26.2.5.20, 27.3.4.11, 28.4.3
erlang-et - update to 23.3.4.19-150300.3.42.1
erlang-diameter - update to 23.3.4.19-150300.3.42.1
erlang-doc - update to 23.3.4.19-150300.3.42.1
erlang-reltool-src - update to 23.3.4.19-150300.3.42.1
erlang-diameter-src - update to 23.3.4.19-150300.3.42.1
erlang-wx-src - update to 23.3.4.19-150300.3.42.1
erlang-wx - update to 23.3.4.19-150300.3.42.1
erlang-debugsource - update to 23.3.4.19-150300.3.42.1
erlang-dialyzer-debuginfo - update to 23.3.4.19-150300.3.42.1
erlang-observer - update to 23.3.4.19-150300.3.42.1
erlang - update to 23.3.4.19-150300.3.42.1
erlang-jinterface - update to 23.3.4.19-150300.3.42.1
erlang-jinterface-src - update to 23.3.4.19-150300.3.42.1
erlang-src - update to 23.3.4.19-150300.3.42.1
erlang-epmd - update to 23.3.4.19-150300.3.42.1
erlang-reltool - update to 23.3.4.19-150300.3.42.1
erlang-debugger - update to 23.3.4.19-150300.3.42.1
erlang-observer-src - update to 23.3.4.19-150300.3.42.1
erlang-dialyzer - update to 23.3.4.19-150300.3.42.1
erlang-epmd-debuginfo - update to 23.3.4.19-150300.3.42.1
erlang-wx-debuginfo - update to 23.3.4.19-150300.3.42.1
erlang-debugger-src - update to 23.3.4.19-150300.3.42.1
erlang-et-src - update to 23.3.4.19-150300.3.42.1
erlang-dialyzer-src - update to 23.3.4.19-150300.3.42.1
erlang-debuginfo - update to 23.3.4.19-150300.3.42.1
erlang-inets - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-ftp - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-examples - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-eunit - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-et - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-erts - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-erl_interface - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-erl_docgen - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-eldap - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-edoc - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-diameter - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-dialyzer - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-debugsource - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-debuginfo - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-debugger - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-crypto - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-compiler - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-common_test - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-asn1 - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-kernel - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-sasl - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-xmerl - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-wx - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-tools - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-tftp - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-syntax_tools - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-stdlib - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-ssl - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-ssh - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-src - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-snmp - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-jinterface - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-runtime_tools - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-reltool - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-public_key - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-parsetools - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-os_mon - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-odbc - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-observer - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-mnesia - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang-megaco - addressed in versions 25.3.2.6-16, 25.3.2.6-17, 25.3.2.6-18
erlang26-dialyzer-src - update to 26.2.1-150300.7.25.1
erlang26-reltool - update to 26.2.1-150300.7.25.1
erlang26-et - update to 26.2.1-150300.7.25.1
erlang26-debugger - update to 26.2.1-150300.7.25.1
erlang26-dialyzer - update to 26.2.1-150300.7.25.1
erlang26-src - update to 26.2.1-150300.7.25.1
erlang26-jinterface-src - update to 26.2.1-150300.7.25.1
erlang26-dialyzer-debuginfo - update to 26.2.1-150300.7.25.1
erlang26-reltool-src - update to 26.2.1-150300.7.25.1
erlang26-debugger-src - update to 26.2.1-150300.7.25.1
erlang26-observer-src - update to 26.2.1-150300.7.25.1
erlang26-diameter - update to 26.2.1-150300.7.25.1
erlang26-et-src - update to 26.2.1-150300.7.25.1
erlang26-wx-debuginfo - update to 26.2.1-150300.7.25.1
erlang26-debuginfo - update to 26.2.1-150300.7.25.1
erlang26-debugsource - update to 26.2.1-150300.7.25.1
erlang26-doc - update to 26.2.1-150300.7.25.1
erlang26-epmd-debuginfo - update to 26.2.1-150300.7.25.1
erlang26-epmd - update to 26.2.1-150300.7.25.1
erlang26-jinterface - update to 26.2.1-150300.7.25.1
erlang26 - update to 26.2.1-150300.7.25.1
erlang26-wx - update to 26.2.1-150300.7.25.1
erlang26-wx-src - update to 26.2.1-150300.7.25.1
erlang26-observer - update to 26.2.1-150300.7.25.1
erlang26-diameter-src - update to 26.2.1-150300.7.25.1
erlang (Debian package) - update to 1:27.3.4.1+dfsg-1+deb13u3

• https://github.com/erlang/otp/security/advisories/GHSA-28jg-mw9x-hpm5

• Authenticated path traversal in Erlang OTP
• SUSE update for erlang26
• openEuler 24.03 LTS SP3 update for erlang
• openEuler 24.03 LTS SP1 update for erlang
• openEuler 24.03 LTS SP4 update for erlang
• IBM PowerVC update for Erlang OTP ssh
• Debian update for erlang
• SUSE update for erlang