CVE-2026-23942

MediumCVSS 5.4/10Last modified Nov 11, 2026

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.

This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.

The SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.

This issue affects OTP from OTP 17.0 before OTP 26.2.5.18, OTP 27.3.4.9, and OTP 28.4.1, corresponding to ssh from 3.0.1 before 5.1.4.14, 5.2.11.6, and 5.5.1. Whether OTP before OTP 17.0, corresponding to ssh before 3.0.1, is affected is unknown.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Mar 13, 2026
Last modified: Nov 11, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-239435.3Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Serv CVE-2026-239449.8Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.13.2, unauthenticated requests coul CVE-2026-239466.8Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below i CVE-2026-239479.8Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.CVE-2026-239487.5FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer dereference vulnerability in rdp_write_logo CVE-2026-239498.6jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vul CVE-2026-23959.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Informatics Technology I CVE-2026-239505.9node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling CVE-2026-239515.5SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that only triggers with exa CVE-2026-239527.5ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointe CVE-2026-239538.7Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a CVE-2026-239548.7Incus is a system container and virtual machine manager. Versions 6.21.0 and below allow a user with the ability to launch a container with