CVE-2026-32147: SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (sshsftpd module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.
The SFTP daemon (sshsftpd) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When SSHFXPFSETSTAT is issued on such a handle, file attributes (permissions, ownership, timestamps) are modified on the real filesystem path, bypassing the root directory boundary entirely.
Any authenticated SFTP user on a server configured with the root option can modify file attributes of files outside the intended chroot boundary. The prerequisite is that a target file must exist on the real filesystem at the same relative path. Note that this vulnerability only allows modification of file attributes; file contents cannot be read or altered through this attack vector.
If the SSH daemon runs as root, this enables direct privilege escalation: an attacker can set the setuid bit on any binary, change ownership of sensitive files, or make system configuration world-writable.
This vulnerability is associated with program files lib/ssh/src/sshsftpd.erl and program routines sshsftpd:doopen/4 and sshsftpd:handleop/4.
This issue affects OTP from OTP 17.0 before OTP 28.4.3, OTP 27.3.4.11 and OTP 26.2.5.20, corresponding to ssh from 3.0.1 before 5.5.3, 5.2.11.7 and 5.1.4.15.
Other sources
SFTP chroot bypass via path traversal in SSHFXPFSETSTAT
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Erlang OTP ssh (ssh_sftpd module)to a version that resolves this vulnerability.Fixed in 28.4.3 - Upgrade
Upgrade
Erlang OTP ssh (ssh_sftpd module)to a version that resolves this vulnerability.Fixed in 27.3.4.11 - Upgrade
Upgrade
Erlang OTP ssh (ssh_sftpd module)to a version that resolves this vulnerability.Fixed in 26.2.5.20 - Upgrade
Upgrade
ssh (from Erlang/OTP)to a version that resolves this vulnerability.Fixed in 5.5.3 - Upgrade
Upgrade
ssh (from Erlang/OTP)to a version that resolves this vulnerability.Fixed in 5.2.11.7 - Upgrade
Upgrade
ssh (from Erlang/OTP)to a version that resolves this vulnerability.Fixed in 5.1.4.15 - Configuration
Upgrade Erlang OTP/SSH components as listed; this is required because ssh_sftpd stores raw user-supplied paths in file handles rather than chroot-resolved paths, enabling SSH_FXP_FSETSTAT to modify attributes outside the chroot boundary.
SSH daemon (SFTP/ssh_sftpd) SFTP chroot enforcement = Fix path traversal by ensuring chroot-resolved paths are used for attribute modifications - Compensating control
If you cannot immediately upgrade, mitigate privilege-escalation risk by avoiding running the SSH daemon as root (since with the SFTP root option this enables setting setuid bits, changing ownership, or making system configuration world-writable).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32147?
CVE-2026-32147 is classified as a high-severity vulnerability due to its potential impact on file system security.
How do I fix CVE-2026-32147?
To fix CVE-2026-32147, upgrade Erlang OTP to a version beyond the vulnerable thresholds listed in the advisory.
Who is affected by CVE-2026-32147?
CVE-2026-32147 affects authenticated SFTP users utilizing specific versions of Erlang OTP and the SSH_FXP_FSETSTAT functionality.
What functionality does CVE-2026-32147 exploit?
CVE-2026-32147 exploits a path traversal vulnerability allowing modification of file attributes outside of the chroot directory.
How can CVE-2026-32147 impact system security?
CVE-2026-32147 can compromise system security by enabling unauthorized access to files outside the intended directory isolation.