CVE-2026-23942

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2. The SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root. This issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.

• CWE-22

• https://cna.erlef.org/cves/CVE-2026-23942.htmlVendor Advisory
• https://github.com/erlang/otp/commit/27688a824f753d4c16371dc70e88753fb410590bPatch
• https://github.com/erlang/otp/commit/5ed603a1211b83b8be2d1fc06d3f3bf30c3c9759Patch
• https://github.com/erlang/otp/commit/9e0ac85d3485e7898e0da88a14be0ee2310a3b28Patch
• https://github.com/erlang/otp/security/advisories/GHSA-4749-w85x-hw9hMitigation, Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-23942Vendor Advisory
• https://www.erlang.org/doc/system/versions.html#order-of-versionsProduct

Published

Mar 13, 2026

Last Modified

Jul 24, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23928The Item history widget (in Zabbix 7.0+) or the Plain text w…7.3
• CVE-2026-2393A Server-Side Request Forgery (SSRF) vulnerability exists in…7.1
• CVE-2026-23939Improper Limitation of a Pathname to a Restricted Directory …7.5
• CVE-2026-2394Buffer Over-read vulnerability in RTI Connext Professional (…6.5
• CVE-2026-23940Uncontrolled Resource Consumption vulnerability in hexpm hex…6.5
• CVE-2026-23941Inconsistent Interpretation of HTTP Requests ('HTTP Request …9.4
• CVE-2026-23943Improper Handling of Highly Compressed Data (Compression Bom…5.3
• CVE-2026-23944Arcane is an interface for managing Docker containers, image…9.8
• CVE-2026-23946Tendenci is an open source content management system built f…6.8
• CVE-2026-23947Orval generates type-safe JS clients (TypeScript) from any v…9.8
• CVE-2026-23948FreeRDP is a free implementation of the Remote Desktop Proto…7.5
• CVE-2026-23949jaraco.context, an open-source software package that provide…8.6