CVE-2026-32147
Full vulnerability record from the local CVENow database.
Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory. The SFTP daemon (ssh_sftpd) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When SSH_FXP_FSETSTAT is issued on such a handle, file attributes (permissions, ownership, timestamps) are modified on the real filesystem path, bypassing the root directory boundary entirely. Any authenticated SFTP user on a server configured with the root option can modify file attributes of files outside the intended chroot boundary. The prerequisite is that a target file must exist on the real filesystem at the same relative path. Note that this vulnerability only allows modification of file attributes; file contents cannot be read or altered through this attack vector. If the SSH daemon runs as root, this enables direct privilege escalation: an attacker can set the setuid bit on any binary, change ownership of sensitive files, or make system configuration world-writable. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:do_open/4 and ssh_sftpd:handle_op/4. This issue affects OTP from OTP 17.0 before OTP 28.4.3, OTP 27.3.4.11 and OTP 26.2.5.20, corresponding to ssh from 3.0.1 before 5.5.3, 5.2.11.7 and 5.1.4.15.
Severity
MEDIUM
CVSS score
5.3
(v4.0)
Vulnerability status
Modified
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-04-21 12:15:58.800000
Last modified
2026-10-26 22:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-32147",
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"published": "2026-04-21T12:15:58.800",
"lastModified": "2026-10-26T22:10:00.163",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.\n\nThe SFTP daemon (ssh_sftpd) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When SSH_FXP_FSETSTAT is issued on such a handle, file attributes (permissions, ownership, timestamps) are modified on the real filesystem path, bypassing the root directory boundary entirely.\n\nAny authenticated SFTP user on a server configured with the root option can modify file attributes of files outside the intended chroot boundary. The prerequisite is that a target file must exist on the real filesystem at the same relative path. Note that this vulnerability only allows modification of file attributes; file contents cannot be read or altered through this attack vector.\n\nIf the SSH daemon runs as root, this enables direct privilege escalation: an attacker can set the setuid bit on any binary, change ownership of sensitive files, or make system configuration world-writable.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:do_open/4 and ssh_sftpd:handle_op/4.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.4.3, OTP 27.3.4.11 and OTP 26.2.5.20, corresponding to ssh from 3.0.1 before 5.5.3, 5.2.11.7 and 5.1.4.15."
},
{
"lang": "es",
"value": "Una vulnerabilidad de Limitación Incorrecta de un Nombre de Ruta a un Directorio Restringido (’Salto de Ruta’) en Erlang OTP ssh (módulo ssh_sftpd) permite a un usuario SFTP autenticado modificar atributos de archivo fuera del directorio chroot configurado.\n\nEl demonio SFTP (ssh_sftpd) almacena la ruta sin procesar, proporcionada por el usuario, en descriptores de archivo en lugar de la ruta resuelta por chroot. Cuando SSH_FXP_FSETSTAT se emite en dicho descriptor, los atributos de archivo (permisos, propiedad, marcas de tiempo) se modifican en la ruta real del sistema de archivos, eludiendo por completo el límite del directorio raíz.\n\nCualquier usuario SFTP autenticado en un servidor configurado con la opción root puede modificar atributos de archivo de archivos fuera del límite chroot previsto. El requisito previo es que un archivo de destino debe existir en el sistema de archivos real en la misma ruta relativa. Tenga en cuenta que esta vulnerabilidad solo permite la modificación de atributos de archivo; el contenido de los archivos no puede ser leído o alterado a través de este vector de ataque.\n\nSi el demonio SSH se ejecuta como root, esto permite una escalada de privilegios directa: un atacante puede establecer el bit setuid en cualquier binario, cambiar la propiedad de archivos sensibles o hacer que la configuración del sistema sea de escritura global.\n\nEsta vulnerabilidad está asociada con los archivos de programa lib/ssh/src/ssh_sftpd.erl y las rutinas de programa ssh_sftpd:do_open/4 y ssh_sftpd:handle_op/4.\n\nEste problema afecta a OTP desde OTP 17.0 hasta OTP 28.4.3, 27.3.4.11 y 26.2.5.20 correspondiente a ssh desde 3.01 hasta 5.5.3, 5.2.11.7 y 5.1.4.15."
}
],
"affected": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"affectedData": [
{
"vendor": "Erlang",
"product": "OTP",
"defaultStatus": "unknown",
"packageName": "ssh",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"modules": [
"ssh_sftpd"
],
"programFiles": [
"src/ssh_sftpd.erl"
],
"programRoutines": [
{
"name": "ssh_sftpd:do_open/4"
},
{
"name": "ssh_sftpd:handle_op/4"
}
],
"repo": "https://github.com/erlang/otp",
"packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"versions": [
{
"version": "3.01",
"lessThan": "*",
"versionType": "otp",
"status": "affected",
"changes": [
{
"at": "5.5.3",
"status": "unaffected"
},
{
"at": "5.2.11.7",
"status": "unaffected"
},
{
"at": "5.1.4.15",
"status": "unaffected"
}
]
}
]
},
{
"vendor": "Erlang",
"product": "OTP",
"defaultStatus": "unknown",
"collectionURL": "https://github.com",
"packageName": "erlang/otp",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"modules": [
"ssh_sftpd"
],
"programFiles": [
"lib/ssh/src/ssh_sftpd.erl"
],
"programRoutines": [
{
"name": "ssh_sftpd:do_open/4"
},
{
"name": "ssh_sftpd:handle_op/4"
}
],
"repo": "https://github.com/erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"versions": [
{
"version": "17.0",
"lessThan": "*",
"versionType": "otp",
"status": "affected",
"changes": [
{
"at": "28.4.3",
"status": "unaffected"
},
{
"at": "27.3.4.11",
"status": "unaffected"
},
{
"at": "26.2.5.20",
"status": "unaffected"
}
]
},
{
"version": "07b8f441ca711f9812fad9e9115bab3c3aa92f79",
"lessThan": "*",
"versionType": "git",
"status": "affected",
"changes": [
{
"at": "28c5d5a6c5f873dc701b597276271763e7d1c004",
"status": "unaffected"
}
]
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-21T13:11:06.946869Z",
"id": "CVE-2026-32147",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionStartIncluding": "17.0",
"versionEndExcluding": "26.2.5.20",
"matchCriteriaId": "E37C60D4-5ECE-43AF-B778-AF1BA602B5F6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionStartIncluding": "27.0",
"versionEndExcluding": "27.3.4.11",
"matchCriteriaId": "53AEBB75-1DCB-4B04-9FA5-2821679CFD52"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionStartIncluding": "28.0",
"versionEndExcluding": "28.4.3",
"matchCriteriaId": "D216AF1C-362E-4C48-B34E-64278BFBC676"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:erlang:erlang\\/ssh:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.0.1",
"versionEndExcluding": "5.1.4.15",
"matchCriteriaId": "AEAA2DA5-E7F4-4C25-AABC-6DEDD0984AE5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:erlang:erlang\\/ssh:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.2",
"versionEndExcluding": "5.2.11.7",
"matchCriteriaId": "55BBE15D-87F3-4922-AEB8-8A2CAFF0EA6E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:erlang:erlang\\/ssh:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.5",
"versionEndExcluding": "5.5.2",
"matchCriteriaId": "964AE32A-19EB-4873-B4E1-E78B2DF3C628"
}
]
}
]
}
],
"references": [
{
"url": "https://cna.erlef.org/cves/CVE-2026-32147.html",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://github.com/erlang/otp/commit/28c5d5a6c5f873dc701b597276271763e7d1c004",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/erlang/otp/security/advisories/GHSA-28jg-mw9x-hpm5",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-32147",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Product"
]
}
]
}