CVE-2026-23942: SFTP root escape via component-agnostic prefix check in ssh_sftpd
- Is it exploited?
Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of . If CISA adds it, this page shows it as known exploited.
- How likely is exploitation in the next 30 days?
- 0.4%
EPSS score, percentile 31.6 of all scored records. A probability estimated by FIRST, not a report of exploitation.
- How severe?
- 5.3 Medium
CVSS v4.0 base score, given by the CNA
- What should I do?
CISA has set no required action, because the vulnerability is not in KEV.
- Which versions are affected?
Affected
- 3.0.1
- 17.0
Unaffected from 5.5.1; from 5.2.11.6; from 5.1.4.14; from 28.4.1; from 27.3.4.9; from 26.2.5.18
Source: CISA KEV 2026.10.29, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.
What to do
Workaround (from the CVE record)
* Use OS-level chroot to run the Erlang VM/SFTP server process in an isolated filesystem environment. * Ensure that no sensitive or precious data is readable or writable by the OS user running the Erlang VM. * Ensure that the SFTP server port is not reachable from untrusted machines. * Use directory naming conventions that avoid common prefixes (e.g., /home/users/alice/ instead of /home/user1/).
Advisories and patches
This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | 3.0.1 |
| Unaffected | from 5.5.1 |
| Unaffected | from 5.2.11.6 |
| Unaffected | from 5.1.4.14 |
Versions not listed are: unknown.
| Status | Versions |
|---|---|
| Affected | 17.0 |
| Unaffected | from 28.4.1 |
| Unaffected | from 27.3.4.9 |
| Unaffected | from 26.2.5.18 |
| Affected | 84adefa331c4 |
| Unaffected | from 27688a824f75 |
| Unaffected | from 9e0ac85d3485 |
| Unaffected | from 5ed603a1211b |
Versions not listed are: unknown.
Versions the record lists as unaffected: 5.5.1, 5.2.11.6, 5.1.4.14, 28.4.1, 27.3.4.9, 26.2.5.18, 27688a824f753d4c16371dc70e88753fb410590b, 9e0ac85d3485e7898e0da88a14be0ee2310a3b28.
Source: CVE List, as of . About the data.
About this vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2. The SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking…
Summary: CVE record, as of .
- CISA has not added CVE-2026-23942 to its Known Exploited Vulnerabilities (KEV) catalog, as of 29 Oct 2026.
- The CVE record was published on 13 Mar 2026.
- The CVE record carries a CVSS v4.0 base score of 5.3 (Medium), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 0.4% (percentile 31.6), as of 29 Oct 2026. EPSS is a statistical estimate, not a report of exploitation.
- CISA's SSVC assessment in the CVE record: exploitation none, automatable yes, technical impact partial.
- The credits in the CVE record name AISLE as finder.
Source: CISA KEV 2026.10.29, as of ; CVE List, as of ; FIRST EPSS, as of . About the data.
Description
SFTP root escape via component-agnostic prefix check in ssh_sftpd
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2. The SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root. This issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.
Source: CVE List, as of . About the data.
Weakness
CWE-22, 1 CAPEC
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Attack patterns (CAPEC)
- CAPEC-126: Path Traversal
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| CVE record last updated |
References
3
Known exploited Erlang vulnerabilities
- CVE-2025-32433: Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability