CVE-2026-48855 Details

A vulnerability in the SSH SFTP server module of Erlang OTP, specifically in versions 17.0 prior to 29.0.2, 28.5.0.2, and 27.3.4.13, allows for the unauthorized disclosure of sensitive filesystem information. The issue arises because the SSH_FXP_READLINK handler fails to remove the backend root prefix from symlink targets before sending them to the client. As a result, an authenticated SFTP client can create a symlink within the chroot directory that points to the root directory. When this symlink is read back through the SSH_FXP_READLINK command, it returns the absolute path from the backend filesystem instead of the expected chrooted path. This leak reveals the full filesystem path of the SFTP root directory and any symlink targets, potentially disclosing information about the host's directory structure, mount points, or usernames, depending on the SFTP root configuration.

Users can update to Erlang OTP versions 29.0.2, 28.5.0.2, or 27.3.4.13, where this vulnerability has been fixed. Alternatively, the SFTP server can be run in an isolated filesystem environment using OS-level chroot, ensuring that the SFTP server port is not accessible from untrusted machines and that no sensitive information can be inferred from the absolute path of the configured root directory.