Erlang/OTP -- SFTP READLINK discloses server filesystem paths

2026-06-10 · CVE-2026-48855 · VuXML entry

https://github.com/erlang/otp/security/advisories/GHSA-pv7g-pjrq-x2fh reports: The SSH SFTP daemon's handling of SSH_FXP_READLINK returned symbolic link targets containing the server's absolute filesystem path, disclosing the backend root prefix to clients. The handler now strips the backend root prefix from symlink targets before returning them.

Affected versions

• erlang-runtime27 < 27.3.4.13
• erlang-runtime28 < 28.5.0.2
• erlang-runtime29 < 29.0.2

By system

2 still vulnerable, 3 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.