Path Traversal Vulnerability in Erlang OTP SFTP Daemon

CVE-2026-32147

What is CVE-2026-32147?

A path traversal vulnerability exists in the Erlang OTP SFTP daemon (ssh_sftpd module), allowing authenticated SFTP users to modify file attributes outside the designated chroot directory. The vulnerability arises because the SFTP daemon uses raw user-supplied paths in file handles rather than paths resolved by chroot, which can lead to unauthorized changes in file permissions, ownership, and timestamps on the real filesystem. As a result, on servers with a misconfigured root option, attackers may leverage this vulnerability to escalate privileges or change critical file properties, provided that the targeted file exists at the specified relative path in the filesystem. Notably, the vulnerability affects versions from OTP 17.0 up to 28.4.3 and is associated with specific Erlang program files.

References