The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.
This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.
The SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.
This issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade erlang | May 19, 2026 | May 19, 2026 |
| Ubuntu | — | Upgrade erlang-x11Upgrade erlang-etUpgrade erlang-ic (Ubuntu Pro)Upgrade erlang (Ubuntu Pro)Upgrade erlang-et (Ubuntu Pro)Upgrade erlang-runtime-toolsUpgrade erlang-ic-java (Ubuntu Pro)Upgrade erlang-baseUpgrade erlang-mnesiaUpgrade erlang-public-key (Ubuntu Pro)Upgrade erlang-megacoUpgrade erlang-nox (Ubuntu Pro)Upgrade erlang-observerUpgrade erlang-modeUpgrade erlang-diameterUpgrade erlang-webtool (Ubuntu Pro)Upgrade erlang-examplesUpgrade erlang-syntax-tools (Ubuntu Pro)Upgrade erlang-wx (Ubuntu Pro)Upgrade erlang-odbc (Ubuntu Pro)Upgrade erlang-eldap (Ubuntu Pro)Upgrade erlang-crypto (Ubuntu Pro)Upgrade erlang-toolbar (Ubuntu Pro)Upgrade erlang-sshUpgrade erlang-src (Ubuntu Pro)Upgrade erlang-dev (Ubuntu Pro)Upgrade erlang-inetsUpgrade erlang-docUpgrade erlang-os-monUpgrade erlang-pman (Ubuntu Pro)Upgrade erlang-dialyzerUpgrade erlang-sslUpgrade erlang-wxUpgrade erlang-mnesia (Ubuntu Pro)Upgrade erlang-dialyzer (Ubuntu Pro)Upgrade erlang-eldapUpgrade erlang-diameter (Ubuntu Pro)Upgrade erlang-runtime-tools (Ubuntu Pro)Upgrade erlang-base (Ubuntu Pro)Upgrade erlang-tv (Ubuntu Pro)Upgrade erlang-common-test (Ubuntu Pro)Upgrade erlang-tools (Ubuntu Pro)Upgrade erlang-debugger (Ubuntu Pro)Upgrade erlang-reltoolUpgrade erlang-tftp (Ubuntu Pro)Upgrade erlang-ftp (Ubuntu Pro)Upgrade erlang-cryptoUpgrade erlang-doc (Ubuntu Pro)Upgrade erlang-inets (Ubuntu Pro)Upgrade erlang-odbcUpgrade erlang-ssh (Ubuntu Pro)Upgrade erlang-parsetools (Ubuntu Pro)Upgrade erlang-megaco (Ubuntu Pro)Upgrade erlang-syntax-toolsUpgrade erlang-ftpUpgrade erlang-xmerlUpgrade erlang-tftpUpgrade erlang-noxUpgrade erlang-percept (Ubuntu Pro)Upgrade erlang-erl-docgen (Ubuntu Pro)Upgrade erlang-eunit (Ubuntu Pro)Upgrade erlang-x11 (Ubuntu Pro)Upgrade erlang-public-keyUpgrade erlang-parsetoolsUpgrade erlang-test-server (Ubuntu Pro)Upgrade erlang-observer (Ubuntu Pro)Upgrade erlang-mode (Ubuntu Pro)Upgrade erlang-ssl (Ubuntu Pro)Upgrade erlang-appmon (Ubuntu Pro)Upgrade erlang-xmerl (Ubuntu Pro)Upgrade erlang-snmpUpgrade erlang-manpagesUpgrade erlang-jinterface (Ubuntu Pro)Upgrade erlang-debuggerUpgrade erlang-reltool (Ubuntu Pro)Upgrade erlang-manpages (Ubuntu Pro)Upgrade erlang-asn1 (Ubuntu Pro)Upgrade erlang-snmp (Ubuntu Pro)Upgrade erlang-asn1Upgrade erlangUpgrade erlang-jinterfaceUpgrade erlang-eunitUpgrade erlang-edocUpgrade erlang-os-mon (Ubuntu Pro)Upgrade erlang-gs (Ubuntu Pro)Upgrade erlang-base-hipe (Ubuntu Pro)Upgrade erlang-common-testUpgrade erlang-corba (Ubuntu Pro)Upgrade erlang-devUpgrade erlang-erl-docgenUpgrade erlang-toolsUpgrade erlang-srcUpgrade erlang-edoc (Ubuntu Pro)Upgrade erlang-typer (Ubuntu Pro)Upgrade erlang-examples (Ubuntu Pro) | Oct 12, 2026 | Oct 8, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Mar 13, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub