Server-Side Request Forgery (SSRF) in otp - CVE-2026-48858

Vulnerability identifier: #VU136818

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-48858

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform server-side request forgery against internal or third-party hosts.

The vulnerability exists due to improper control of a resource through its lifetime in ftp_internal:handle_command/3 when processing PASV responses in passive mode. A remote user can supply a crafted 227 response with an arbitrary IP address and port to perform server-side request forgery against internal or third-party hosts.

On affected operations, the client may read data from or send data to the redirected target instead of the FTP server. The issue affects the PASV path used with the default passive-mode configuration and does not affect the EPSV path.

otp
openEuler
Fedora
erlang-compiler
erlang-reltool
erlang-public_key
erlang-parsetools
erlang-os_mon
erlang-odbc
erlang-observer
erlang-mnesia
erlang-megaco
erlang-kernel
erlang-jinterface
erlang-inets
erlang-hipe
erlang
erlang-asn1
erlang-common_test
erlang-runtime_tools
erlang-crypto
erlang-debugger
erlang-debuginfo
erlang-debugsource
erlang-dialyzer
erlang-diameter
erlang-edoc
erlang-eldap
erlang-erl_docgen
erlang-erl_interface
erlang-erts
erlang-et
erlang-eunit
erlang-examples
erlang-ftp
erlang-sasl
erlang-xmerl
erlang-wx
erlang-tools
erlang-tftp
erlang-syntax_tools
erlang-stdlib
erlang-ssl
erlang-ssh
erlang-snmp
erlang-src

Install security update from vendor's website.

otp - addressed in versions 27.3.4.13, 28.5.0.2, 29.0.2
erlang-compiler - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-reltool - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-public_key - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-parsetools - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-os_mon - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-odbc - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-observer - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-mnesia - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-megaco - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-kernel - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-jinterface - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-inets - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-hipe - update to 23.3.4.9-11
erlang - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-asn1 - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-common_test - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-runtime_tools - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-crypto - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-debugger - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-debuginfo - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-debugsource - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-dialyzer - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-diameter - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-edoc - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-eldap - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-erl_docgen - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-erl_interface - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-erts - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-et - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-eunit - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-examples - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-ftp - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-sasl - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-xmerl - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-wx - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-tools - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-tftp - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-syntax_tools - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-stdlib - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-ssl - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-ssh - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-snmp - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-src - update to 25.3.2.6-18
erlang - addressed in versions 26.2.5.21-4.fc43, 26.2.5.21-4.fc44

• https://github.com/erlang/otp/security/advisories/GHSA-24cv-hwgr-37fq

• Multiple vulnerabilities in otp
• Fedora 44 update for erlang
• Fedora 43 update for erlang
• openEuler 24.03 LTS SP1 update for erlang
• openEuler 22.03 LTS SP4 update for erlang
• openEuler 24.03 LTS SP4 update for erlang
• openEuler 24.03 LTS SP3 update for erlang