FKIE_CVE-2026-32147

Vulnerability from fkie_nvd - Published: 2026-04-21 12:15 - Updated: 2026-11-11 20:17
Severity
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory. The SFTP daemon (ssh_sftpd) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When SSH_FXP_FSETSTAT is issued on such a handle, file attributes (permissions, ownership, timestamps) are modified on the real filesystem path, bypassing the root directory boundary entirely. Any authenticated SFTP user on a server configured with the root option can modify file attributes of files outside the intended chroot boundary. The prerequisite is that a target file must exist on the real filesystem at the same relative path. Note that this vulnerability only allows modification of file attributes; file contents cannot be read or altered through this attack vector. If the SSH daemon runs as root, this enables direct privilege escalation: an attacker can set the setuid bit on any binary, change ownership of sensitive files, or make system configuration world-writable. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:do_open/4 and ssh_sftpd:handle_op/4. This issue affects OTP from OTP 17.0 before OTP 26.2.5.20, OTP 27.3.4.11, and OTP 28.4.3, corresponding to ssh from 3.0.1 before 5.1.4.15, 5.2.11.7, and 5.5.2. Whether OTP before OTP 17.0, corresponding to ssh before 3.0.1, is affected is unknown.
References
6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://cna.erlef.org/cves/CVE-2026-32147.htmlVendor Advisory
6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79
6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://github.com/erlang/otp/commit/28c5d5a6c5f873dc701b597276271763e7d1c004Patch
6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://github.com/erlang/otp/security/advisories/GHSA-28jg-mw9x-hpm5Vendor Advisory
6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://osv.dev/vulnerability/EEF-CVE-2026-32147Third Party Advisory
6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://www.erlang.org/doc/system/versions.html#order-of-versionsProduct
Impacted products
Vendor Product Version
erlang erlang\/otp *
erlang erlang\/otp *
erlang erlang\/otp *
erlang erlang\/ssh *
erlang erlang\/ssh *
erlang erlang\/ssh *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "modules": [
            "ssh_sftpd"
          ],
          "packageName": "otp",
          "packageURL": "pkg:software-id/erlang.org/otp",
          "product": "OTP",
          "programFiles": [
            "lib/ssh/src/ssh_sftpd.erl"
          ],
          "programRoutines": [
            {
              "name": "ssh_sftpd:do_open/4"
            },
            {
              "name": "ssh_sftpd:handle_op/4"
            }
          ],
          "vendor": "Erlang",
          "versions": [
            {
              "changes": [
                {
                  "at": "26.2.5.20",
                  "status": "unaffected"
                },
                {
                  "at": "27.3.4.11",
                  "status": "unaffected"
                },
                {
                  "at": "28.4.3",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "17.0",
              "versionType": "otp"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "modules": [
            "ssh_sftpd"
          ],
          "packageName": "ssh",
          "packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp\u0026vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
          "product": "OTP",
          "programFiles": [
            "src/ssh_sftpd.erl"
          ],
          "programRoutines": [
            {
              "name": "ssh_sftpd:do_open/4"
            },
            {
              "name": "ssh_sftpd:handle_op/4"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "vendor": "Erlang",
          "versions": [
            {
              "changes": [
                {
                  "at": "5.1.4.15",
                  "status": "unaffected"
                },
                {
                  "at": "5.2.11.7",
                  "status": "unaffected"
                },
                {
                  "at": "5.5.2",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "3.0.1",
              "versionType": "otp"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "modules": [
            "ssh_sftpd"
          ],
          "packageName": "erlang/otp",
          "packageURL": "pkg:github/erlang/otp",
          "product": "OTP",
          "programFiles": [
            "lib/ssh/src/ssh_sftpd.erl"
          ],
          "programRoutines": [
            {
              "name": "ssh_sftpd:do_open/4"
            },
            {
              "name": "ssh_sftpd:handle_op/4"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "vendor": "Erlang",
          "versions": [
            {
              "lessThan": "28c5d5a6c5f873dc701b597276271763e7d1c004",
              "status": "affected",
              "version": "07b8f441ca711f9812fad9e9115bab3c3aa92f79",
              "versionType": "git"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "28c5d5a6c5f873dc701b597276271763e7d1c004",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E37C60D4-5ECE-43AF-B778-AF1BA602B5F6",
              "versionEndExcluding": "26.2.5.20",
              "versionStartIncluding": "17.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "53AEBB75-1DCB-4B04-9FA5-2821679CFD52",
              "versionEndExcluding": "27.3.4.11",
              "versionStartIncluding": "27.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D216AF1C-362E-4C48-B34E-64278BFBC676",
              "versionEndExcluding": "28.4.3",
              "versionStartIncluding": "28.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:erlang:erlang\\/ssh:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AEAA2DA5-E7F4-4C25-AABC-6DEDD0984AE5",
              "versionEndExcluding": "5.1.4.15",
              "versionStartIncluding": "3.0.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:erlang:erlang\\/ssh:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "55BBE15D-87F3-4922-AEB8-8A2CAFF0EA6E",
              "versionEndExcluding": "5.2.11.7",
              "versionStartIncluding": "5.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:erlang:erlang\\/ssh:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "964AE32A-19EB-4873-B4E1-E78B2DF3C628",
              "versionEndExcluding": "5.5.2",
              "versionStartIncluding": "5.5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.\n\nThe SFTP daemon (ssh_sftpd) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When SSH_FXP_FSETSTAT is issued on such a handle, file attributes (permissions, ownership, timestamps) are modified on the real filesystem path, bypassing the root directory boundary entirely.\n\nAny authenticated SFTP user on a server configured with the root option can modify file attributes of files outside the intended chroot boundary. The prerequisite is that a target file must exist on the real filesystem at the same relative path. Note that this vulnerability only allows modification of file attributes; file contents cannot be read or altered through this attack vector.\n\nIf the SSH daemon runs as root, this enables direct privilege escalation: an attacker can set the setuid bit on any binary, change ownership of sensitive files, or make system configuration world-writable.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:do_open/4 and ssh_sftpd:handle_op/4.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.20, OTP\u00a027.3.4.11, and OTP\u00a028.4.3, corresponding to ssh from 3.0.1 before 5.1.4.15, 5.2.11.7, and 5.5.2. Whether OTP before OTP\u00a017.0, corresponding to ssh before 3.0.1, is affected is unknown."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Limitaci\u00f3n Incorrecta de un Nombre de Ruta a un Directorio Restringido (\u2019Salto de Ruta\u2019) en Erlang OTP ssh (m\u00f3dulo ssh_sftpd) permite a un usuario SFTP autenticado modificar atributos de archivo fuera del directorio chroot configurado.\n\nEl demonio SFTP (ssh_sftpd) almacena la ruta sin procesar, proporcionada por el usuario, en descriptores de archivo en lugar de la ruta resuelta por chroot. Cuando SSH_FXP_FSETSTAT se emite en dicho descriptor, los atributos de archivo (permisos, propiedad, marcas de tiempo) se modifican en la ruta real del sistema de archivos, eludiendo por completo el l\u00edmite del directorio ra\u00edz.\n\nCualquier usuario SFTP autenticado en un servidor configurado con la opci\u00f3n root puede modificar atributos de archivo de archivos fuera del l\u00edmite chroot previsto. El requisito previo es que un archivo de destino debe existir en el sistema de archivos real en la misma ruta relativa. Tenga en cuenta que esta vulnerabilidad solo permite la modificaci\u00f3n de atributos de archivo; el contenido de los archivos no puede ser le\u00eddo o alterado a trav\u00e9s de este vector de ataque.\n\nSi el demonio SSH se ejecuta como root, esto permite una escalada de privilegios directa: un atacante puede establecer el bit setuid en cualquier binario, cambiar la propiedad de archivos sensibles o hacer que la configuraci\u00f3n del sistema sea de escritura global.\n\nEsta vulnerabilidad est\u00e1 asociada con los archivos de programa lib/ssh/src/ssh_sftpd.erl y las rutinas de programa ssh_sftpd:do_open/4 y ssh_sftpd:handle_op/4.\n\nEste problema afecta a OTP desde OTP 17.0 hasta OTP 28.4.3, 27.3.4.11 y 26.2.5.20 correspondiente a ssh desde 3.01 hasta 5.5.3, 5.2.11.7 y 5.1.4.15."
    }
  ],
  "id": "CVE-2026-32147",
  "lastModified": "2026-11-11T20:17:09.550",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "LOW",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-32147",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-21T13:11:06.946869Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-21T12:15:58.800",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cna.erlef.org/cves/CVE-2026-32147.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/erlang/otp/commit/28c5d5a6c5f873dc701b597276271763e7d1c004"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/erlang/otp/security/advisories/GHSA-28jg-mw9x-hpm5"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32147"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Product"
      ],
      "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.