Skip to content
Heist/ feed
UnratedFix available

DEBIAN-CVE-2026-23942

Type: advisorySource: OSV1 source record

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2. The SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root. This issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.

Announced Source revision 1
Original source ↗

DEBIAN-CVE-2026-23942

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-23942

erlang

Source reference: /affected/0/package/name

Affected versions
1:25.2.3+dfsg-1

Source reference: /affected/0/versions

1:25.2.3+dfsg-1+deb12u1

Source reference: /affected/0/versions

1:25.2.3+dfsg-1+deb12u2

Source reference: /affected/0/versions

1:25.2.3+dfsg-1+deb12u3

Source reference: /affected/0/versions

Fixed versions
1:25.2.3+dfsg-1+deb12u4

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

erlang

Source reference: /affected/1/package/name

Affected versions
1:27.3.4.1+dfsg-1

Source reference: /affected/1/versions

1:27.3.4.1+dfsg-1+deb13u1

Source reference: /affected/1/versions

Fixed versions
1:27.3.4.1+dfsg-1+deb13u2

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

erlang

Source reference: /affected/2/package/name

Affected versions
1:27.3.4.1+dfsg-1

Source reference: /affected/2/versions

1:27.3.4.3+dfsg-1

Source reference: /affected/2/versions

1:27.3.4.4+dfsg-1

Source reference: /affected/2/versions

1:27.3.4.6+dfsg-1

Source reference: /affected/2/versions

1:27.3.4.8+dfsg-1

Source reference: /affected/2/versions

Fixed versions
1:27.3.4.9+dfsg-1

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:25.2.3+dfsg-1+deb12u4"
          }
        ]
      }
    ],
    "package": {
      "name": "erlang",
      "purl": "pkg:deb/debian/erlang?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "1:25.2.3+dfsg-1",
      "1:25.2.3+dfsg-1+deb12u1",
      "1:25.2.3+dfsg-1+deb12u2",
      "1:25.2.3+dfsg-1+deb12u3"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-23942.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:27.3.4.1+dfsg-1+deb13u2"
          }
        ]
      }
    ],
    "package": {
      "name": "erlang",
      "purl": "pkg:deb/debian/erlang?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "1:27.3.4.1+dfsg-1",
      "1:27.3.4.1+dfsg-1+deb13u1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-23942.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:27.3.4.9+dfsg-1"
          }
        ]
      }
    ],
    "package": {
      "name": "erlang",
      "purl": "pkg:deb/debian/erlang?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "1:27.3.4.1+dfsg-1",
      "1:27.3.4.3+dfsg-1",
      "1:27.3.4.4+dfsg-1",
      "1:27.3.4.6+dfsg-1",
      "1:27.3.4.8+dfsg-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-23942.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#56227 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement