Path Traversal Vulnerability in Erlang OTP's SFTP Module

CVE-2026-23942

What is CVE-2026-23942?

The vulnerability in Erlang OTP's SFTP server arises from inadequate path component validation when determining if a specified path is within the permitted root directory. Instead of properly verifying path components, the server erroneously relies on prefix matching, allowing authenticated users to potentially traverse outside the intended directory structure. This weakness enables access to adjacent directories with similar names, which can expose sensitive files or lead to unauthorized actions, compromising the overall security of the system.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References