CVE-2026-48855: SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (sshsftpd module) allows File Discovery.
The SSHFXPREADLINK handler in sshsftpd sends the raw result of file:readlink/2 to the client without calling chrootfilename/2 to strip the backend root prefix. An authenticated SFTP client can create a symlink inside the chroot pointing to /; sshsftpd resolves the target to the absolute backend root and stores it on disk. Reading the symlink back via SSHFXPREADLINK returns that absolute path, for example /data/sftp, instead of the chrooted value /.
The information disclosed is the absolute filesystem path of the SFTP root directory and of any symlink targets within it. No file contents, credentials, or access to paths outside the root directory are obtainable through this issue alone.
This vulnerability is associated with program files lib/ssh/src/sshsftpd.erl.
This issue affects OTP from OTP 17.0 before 29.0.2, 28.5.0.2 and 27.3.4.13 corresponding to ssh from 3.0.1 before 6.0.1, 5.5.2.1 and 5.2.11.8.
Other sources
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (sshsftpd module) allows File Discovery.
The SSHFXPREADLINK handler in sshsftpd sends the raw result of file:readlink/2 to the client without calling chrootfilename/2 to strip the backend root prefix. An authenticated SFTP client can create a symlink inside the chroot pointing to /; sshsftpd resolves the target to the absolute backend root and stores it on disk. Reading the symlink back via SSHFXPREADLINK returns that absolute path, for example /data/sftp, instead of the chrooted value /.
The information disclosed is the absolute filesystem path of the SFTP root directory and of any symlink targets within it. No file contents, credentials, or access to paths outside the root directory are obtainable through this issue alone.
This vulnerability is associated with program files lib/ssh/src/sshsftpd.erl.
This issue affects OTP from OTP 17.0 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to ssh from 3.0.1 before 6.0.1, 5.5.2.1 and 5.2.11.8.
— MITRE
SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.2.5.21-2 - Upgrade
Upgrade
Erlang OTP ssh (ssh_sftpd module)to a version that resolves this vulnerability.Fixed in 29.0.2 - Upgrade
Upgrade
Erlang OTP ssh (ssh_sftpd module)to a version that resolves this vulnerability.Fixed in 28.5.0.2 - Upgrade
Upgrade
Erlang OTP ssh (ssh_sftpd module)to a version that resolves this vulnerability.Fixed in 27.3.4.13 - Compensating control
If upgrading is not immediately possible, mitigate File Discovery by restricting/limiting SFTP access so that unauthorized actors cannot authenticate and issue SFTP READLINK requests (e.g., enforce strong authentication and reduce who can reach the SFTP service).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48855?
The severity of CVE-2026-48855 is classified as low with a CVSS score of 4.0.
What type of vulnerability is CVE-2026-48855?
CVE-2026-48855 is an exposure of sensitive information vulnerability that allows file discovery.
How does CVE-2026-48855 affect the Erlang OTP ssh module?
CVE-2026-48855 allows the SFTP READLINK handler to leak absolute backend filesystem paths when root is configured.
Who is affected by CVE-2026-48855?
CVE-2026-48855 affects users of the Erlang OTP ssh module, particularly in configurations where root access is allowed.
How can CVE-2026-48855 be mitigated?
Mitigation for CVE-2026-48855 involves updating the Erlang OTP to a version that addresses this vulnerability.