Information disclosure in otp - CVE-2026-48855
Published: July 2, 2026
Vulnerability identifier: #VU136821
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-48855
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: erlang
Affected software:
otp
otp
Detailed vulnerability description
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the SSH_FXP_READLINK handler in ssh_sftpd when reading symlink targets. A remote user can create a symlink and read it back via SFTP to disclose sensitive information.
Only configurations that use the SFTP root option are affected. The issue discloses absolute backend filesystem paths for the configured SFTP root directory and symlink targets within it, but does not by itself provide file contents or access outside the configured root.
How to mitigate CVE-2026-48855
Install security update from vendor's website.