Path Traversal Vulnerability in Erlang OTP's SFTP Module

CVE-2026-23942

What is CVE-2026-23942?

The vulnerability in Erlang OTP's SFTP server arises from inadequate path component validation when determining if a specified path is within the permitted root directory. Instead of properly verifying path components, the server erroneously relies on prefix matching, allowing authenticated users to potentially traverse outside the intended directory structure. This weakness enables access to adjacent directories with similar names, which can expose sensitive files or lead to unauthorized actions, compromising the overall security of the system.

References