CVE-2026-48858

Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address. The ftp_internal:handle_ctrl_result/2 PASV handler (mode=passive, ipfamily=inet, ftp_extension=false) extracts the IP address from the server's 227 response and passes it directly to gen_tcp:connect/4 without validating it against the control connection peer address. The adjacent EPSV handlers correctly call peername(CSock) to derive the IP from the control connection, but the PASV handler does not. A malicious or compromised FTP server can redirect the client's data connection to an arbitrary internal host and port. On read operations (ftp:ls/1,2, ftp:nlist/1,2, ftp:recv/2,3), data from the redirected target is returned to the caller. On write operations (ftp:send/2,3, ftp:append/2,3), file content is sent to the redirected target. This enables SSRF against internal hosts, cloud metadata endpoints, and FTP bounce attacks against third-party hosts. The vulnerable path is the default configuration (mode=passive, ipfamily=inet, ftp_extension=false). RFC 2577 section 3 explicitly recommends validating the PASV response IP against the control connection peer. The ftp application is deprecated and scheduled for removal in OTP-30. This vulnerability is associated with program files lib/inets/src/ftp/ftp_internal.erl (inets 5.10.4 through 6.5, OTP 17.4 through 20.3) and lib/ftp/src/ftp_internal.erl (ftp 1.0 and later, OTP 21.0 and later). This issue affects OTP from OTP 17.4 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to inets from 5.10.4 before 7.0 and ftp from 1.0 before 1.2.6, 1.2.4.1 and 1.2.3.1.

• CWE-918

• https://cna.erlef.org/cves/CVE-2026-48858.htmlMitigation, Third Party Advisory
• https://github.com/erlang/otp/commit/2691a806231ffd0490a8a9e20500dec0c7e73727Patch
• https://github.com/erlang/otp/commit/521bcfa24407ee8cb5614823cf905c37ea3aa605Patch
• https://github.com/erlang/otp/security/advisories/GHSA-24cv-hwgr-37fqMitigation, Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-48858Mitigation, Third Party Advisory
• https://www.erlang.org/doc/system/versions.html#order-of-versionsProduct

Published

Jun 10, 2026

Last Modified

Jul 24, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48851PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a tr…3.1
• CVE-2026-48852PuTTY 0.71 before 0.84 has an assertion failure in ECDSA sig…3.7
• CVE-2026-48853Deserialization of Untrusted Data and Allocation of Resource…9.2
• CVE-2026-48854Allocation of Resources Without Limits or Throttling vulnera…8.7
• CVE-2026-48855Exposure of Sensitive Information to an Unauthorized Actor v…6.5
• CVE-2026-48856Sensitive Data Exposure vulnerability in Erlang OTP inets (h…6.5
• CVE-2026-48859Observable Timing Discrepancy vulnerability in Erlang/OTP ss…5.3
• CVE-2026-48860Reliance on IP Address for Authentication vulnerability in E…6.5
• CVE-2026-48861Improper Neutralization of CRLF Sequences ('CRLF Injection')…2.1
• CVE-2026-48862Allocation of Resources Without Limits or Throttling vulnera…8.2
• CVE-2026-48863A flaw was found in libsolv. A stack-based buffer overflow v…7.5
• CVE-2026-48864A flaw was found in libsolv. This heap buffer overflow occur…7.8