CVE-2026-32147 SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT
Authenticated SFTP users can bypass chroot restrictions to modify file attributes outside the sandbox, potentially leading to privilege escalation if the daemon runs as root.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32147?
CVE-2026-32147 is a medium-severity path traversal vulnerability in Erlang OTP, published on 21 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.
The SFTP daemon (ssh_sftpd) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When SSH_FXP_FSETSTAT is issued on such a handle, file attributes (permissions, ownership, timestamps) are modified on the real filesystem path, bypassing the root directory boundary entirely.
Any authenticated SFTP user on a server configured with the root option can modify file attributes of files outside the intended chroot boundary. The prerequisite is that a target file must exist on the real filesystem at the same relative path. Note that this vulnerability only allows modification of file attributes; file contents cannot be read or altered through this attack vector.
If the SSH daemon runs as root, this enables direct privilege escalation: an attacker can set the setuid bit on any binary, change ownership of sensitive files, or make system configuration world-writable.
This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:do_open/4 and ssh_sftpd:handle_op/4.
This issue affects OTP from OTP 17.0 before OTP 28.4.3, OTP 27.3.4.11 and OTP 26.2.5.20, corresponding to ssh from 3.0.1 before 5.5.3, 5.2.11.7 and 5.1.4.15.
Weakness: CWE-22
Which versions are affected by CVE-2026-32147?
It affects 2 products.
Linux distribution packages (1)
erlang SUSE:Linux Enterprise Module for Server Applications 15 SP7 | All versions | 23.3.4.19-150300.3.42.1 |
Products include Erlang Erlang\/Otp, Erlang Erlang\/Ssh.
How do I fix CVE-2026-32147?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-32147 being exploited?
There is no known exploitation of CVE-2026-32147 in the wild and no public exploit code.
Other vulnerabilities in Erlang OTP
- CVE-2022-37026 Auth bypass in n/a
- CVE-2016-10253 Memory corruption in n/a
- CVE-2026-55953 TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
- CVE-2026-49759 Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash
- CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain
Sources
Also known as AZL-84065, DEBIAN-CVE-2026-32147, EEF-CVE-2026-32147, GHSA-28jg-mw9x-hpm5, OESA-2026-2940, OESA-2026-2941 and 2 more.