File Discovery Vulnerability in Erlang OTP SFTP Module

CVE-2026-48855

What is CVE-2026-48855?

A vulnerability exists in the ssh_sftpd module of Erlang OTP that enables an authenticated SFTP client to create symbolic links pointing to sensitive system paths. The vulnerability occurs as the SSH_FXP_READLINK handler returns the absolute filesystem path of the SFTP root directory instead of the expected chrooted value. This can lead to the disclosure of sensitive file paths within the SFTP server, although it does not allow access to file contents or unauthorized system files.

References