Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal. This vulnerability is associated with program fil…
中危 CVSS 5.4
摘要
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2. The SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access siblin…
中文摘要建设中，暂以英文摘要呈现（DR-003 v2）。
深度研判 · 自动通道
该漏洞尚未生成深度研判报告（DR-003 v2 AI pipeline 建设中）。
受影响产品
- :
Lint 边界警告 (1)
以下是本次研判 lint 阶段发现的非阻塞性警告（如引用 URL 未在白名单内）。这些不影响漏洞条目可用性，仅为透明度披露（参 DR-002）。
-
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://www.erlang.org/doc/system/versions.html#order-of-versions
数据来源
- NVD DATABASE
原始链接
- https://cna.erlef.org/cves/CVE-2026-23942.html Vendor Advisory
- https://github.com/erlang/otp/commit/27688a824f753d4c16371dc70e88753fb410590b Patch
- https://github.com/erlang/otp/commit/5ed603a1211b83b8be2d1fc06d3f3bf30c3c9759 Patch
- https://github.com/erlang/otp/commit/9e0ac85d3485e7898e0da88a14be0ee2310a3b28 Patch
- https://github.com/erlang/otp/security/advisories/GHSA-4749-w85x-hw9h Mitigation
- https://osv.dev/vulnerability/EEF-CVE-2026-23942 Vendor Advisory
- https://www.erlang.org/doc/system/versions.html#order-of-versions Product
时间线
- nvd_ingest NVD