CVE-2026-23942: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-23942 is a path traversal vulnerability (CWE-22) in the Erlang OTP ssh_sftpd module that allows authenticated SFTP users to escape the configured root directory and access sibling directories sharing a common name prefix. The flaw was disclosed on March 13, 2026, and affects Erlang OTP from version 17.0 up to (but not including) 28.4.1, 27.3.4.9, and 26.2.5.18, corresponding to the ssh application versions 3.0.1 through 5.5.1, 5.2.11.6, and 5.1.4.14. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Feedly).

The root cause lies in the ssh_sftpd:is_within_root/2 function in lib/ssh/src/ssh_sftpd.erl, which used Erlang's lists:prefix/2 for string-level prefix matching rather than proper path component validation. This means that if the SFTP root is configured as /home/user1, paths such as /home/user10, /home/user123, or /home/user1_backup would incorrectly pass the boundary check because they share the string prefix /home/user1. The fix replaces the naive string comparison with filename:split/1-based component-level matching via a new is_prefix_components/2 helper, ensuring each path segment is compared individually (GitHub Advisory, OTP Commit maint-28). Exploitation requires the attacker to be an authenticated SFTP user on a server that has the root option configured, and that sibling directories with a matching name prefix exist on the filesystem.

Successful exploitation allows an authenticated SFTP user to read and modify files in sibling directories outside the intended root, bypassing the application-level directory isolation provided by the root option. The confidentiality and integrity of data in those sibling directories are at risk — an attacker could exfiltrate sensitive files or tamper with data belonging to other users or system components. Availability is not directly impacted, and the vulnerability does not affect systems where the root option is not configured or where no sibling directories with a common name prefix exist (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation as of the time of this report (Feedly). The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires valid SFTP credentials and a specific filesystem layout (sibling directories with a common name prefix), which limits the practical attack surface.

1. Reconnaissance: Identify Erlang OTP SFTP servers (versions 17.0–28.4.0, 27.x before 27.3.4.9, or 26.x before 26.2.5.18) exposed on the network, typically on TCP port 22. Confirm the server uses the root option by attempting to connect and observing directory listing behavior.
2. Obtain SFTP credentials: Acquire valid SFTP credentials through legitimate means (e.g., a provisioned account) or through credential theft, since exploitation requires authentication.
3. Enumerate root directory name: After authenticating, determine the configured root directory name (e.g., /home/user1) by observing the apparent filesystem root presented to the SFTP session.
4. Craft sibling path: Construct a path that shares the string prefix of the root directory but refers to a sibling directory (e.g., if root is /home/user1, attempt to access /home/user10/sensitive_file or /home/user1_backup/config).
5. Send SFTP file access request: Using any standard SFTP client, issue a file open or read request using the crafted path (e.g., get /../user10/sensitive_file or get ../../user1_backup/config). The vulnerable is_within_root/2 function will incorrectly validate the path as within root.
6. Exfiltrate or modify data: Read or write files in the sibling directory, bypassing the intended access restriction (GitHub Advisory, OTP Commit maint-28).

• Logs: SFTP server logs showing authenticated file access requests to paths outside the configured root directory, particularly paths that share a name prefix with the root (e.g., requests to /home/user10/ when root is /home/user1/); unexpected file read/write operations in sibling directories by SFTP users.
• File System: Unexpected access timestamps (atime) on files in directories adjacent to the SFTP root that share a common name prefix; new or modified files in sibling directories that SFTP users should not have access to.
• Network: SFTP sessions (SSH port 22) where a user accesses an unusually large number of files or directories, or accesses paths that resolve outside the expected root directory tree.

Upgrade Erlang OTP to one of the patched versions: 26.2.5.18, 27.3.4.9, or 28.4.1 (corresponding to ssh versions 5.1.4.14, 5.2.11.6, and 5.5.1 respectively). If immediate upgrade is not possible, the following workarounds can reduce risk: use OS-level chroot to isolate the Erlang VM/SFTP server process; ensure no sensitive data is readable or writable by the OS user running the Erlang VM; restrict SFTP server port access to trusted hosts via firewall rules; and adopt directory naming conventions that avoid common prefixes (e.g., use /home/users/alice/ instead of /home/user1/) (GitHub Advisory, Feedly). IBM PowerVC and Microsoft Azure Linux distributions bundling affected Erlang versions should also apply vendor-specific updates (IBM Advisory, Microsoft MSRC).

The vulnerability was responsibly disclosed by Luigino Camastra at Aisle Research to the Erlang/OTP project, which coordinated patched releases across three active OTP branches simultaneously (GitHub Advisory). Patch announcements were posted to the Erlang Forums and Elixir Forum communities, where the releases were noted as routine security maintenance. Downstream Linux distributions including Debian, SUSE/openSUSE, and Red Hat have issued security advisories and updated packages. No significant controversy or widespread alarm has been observed in the security community, consistent with the moderate severity rating and lack of known active exploitation.