# CVE-2026-53422: SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured root

Status: published. Published: 2026-07-02. Updated: 2026-11-11.

Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory.

The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths.

An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points.

The vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities.

This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.14, OTP 28.5.0.3, and OTP 29.0.3, corresponding to ssh from 3.0.1 before 5.2.11.9, 5.5.2.2, and 6.0.2. Whether OTP before OTP 17.0, corresponding to ssh before 3.0.1, is affected is unknown.

## Remediation

- workaround: * Use OS-level chroot to run the Erlang VM or SFTP server process in an isolated filesystem environment, eliminating reliance on the application-level root option.
* Ensure the SFTP server port on the machine running the Erlang/OTP SFTP server is not reachable from untrusted machines.
* Ensure that no sensitive information (usernames, project names, mount topology) is inferrable from the existence or non-existence of paths on the host filesystem. (source: CNA: EEF)
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: EEF) — https://github.com/erlang/otp/commit/86622cfaacf57a02c7645d1999f946846b504c94
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: EEF) — https://github.com/erlang/otp/commit/c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: EEF) — https://github.com/erlang/otp/commit/059e5785ef8c1d423820ca633fb7b37f47645172

## Affected products and versions

- Erlang / OTP (otp): ≥ 17.0; < * (affected, otp); unaffected at 27.3.4.14; unaffected at 28.5.0.3; unaffected at 29.0.3. Source: CNA: EEF
- Erlang / OTP (ssh): ≥ 3.0.1; < * (affected, otp); unaffected at 5.2.11.9; unaffected at 5.5.2.2; unaffected at 6.0.2. Source: CNA: EEF
- Erlang / OTP (erlang/otp): ≥ 84adefa331c4159d432d22840663c38f155cd4c1; < * (affected, git); unaffected at 86622cfaacf57a02c7645d1999f946846b504c94; unaffected at c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a; unaffected at 059e5785ef8c1d423820ca633fb7b37f47645172; ≥ 86622cfaacf57a02c7645d1999f946846b504c94; < * (unaffected, git); ≥ c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a; < * (unaffected, git); ≥ 059e5785ef8c1d423820ca633fb7b37f47645172; < * (unaffected, git). Source: CNA: EEF

## Severity and prioritization

- CVSS 4.0: 2.3 (low); CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N; source: CNA: EEF

- CISA KEV: No listing in collected sources

- EPSS: 0.26% as of 2026-11-10; percentile 18.12%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-204

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/erlang/otp/security/advisories/GHSA-h9pw-h5w4-h976 (CNA: EEF; vendor-advisory, related)

- https://cna.erlef.org/cves/CVE-2026-53422.html (CNA: EEF; related)

- https://osv.dev/vulnerability/EEF-CVE-2026-53422 (CNA: EEF; related)

- https://www.erlang.org/doc/system/versions.html#order-of-versions (CNA: EEF; x_version-scheme)

- https://github.com/erlang/otp/commit/86622cfaacf57a02c7645d1999f946846b504c94 (CNA: EEF; patch)

- https://github.com/erlang/otp/commit/c5a8f50ae68888ff243c5c741a06d2b3a4b48b7a (CNA: EEF; patch)

- https://github.com/erlang/otp/commit/059e5785ef8c1d423820ca633fb7b37f47645172 (CNA: EEF; patch)

## Provenance

- CNA: EEF: https://www.cve.org/CVERecord?id=CVE-2026-53422; retrieved 2026-11-11; source updated 2026-11-11

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-53422; retrieved 2026-11-11; source updated Not reported

Revision: b30b601186f809c10c7251f19b372dc3314ad7c3f096594a16cdfc2a7a9c59bd

Canonical: https://y2.dev/cve/CVE-2026-53422

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.