Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory. The SFTP daemon (ssh_sftpd) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When SSH_FXP_FSETSTAT is issued on such a handle, file attributes (permissions, ownership, timestamps) are modified on the real filesystem path, bypassing the root directory boundary entirely. Any authenticated SFTP user on a server configured with the root option can modify file attributes of files outside the intended chroot boundary. The prerequisite is that a target file must exist on the real filesystem at the same relative path. Note that this vulnerability only allows modification of file attributes; file contents cannot be read or altered through this attack vector. If the SSH daemon runs as root, this enables direct privilege escalation: an attacker can set the setuid bit on any binary, change ownership of sensitive files, or make system configuration world-writable. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:do_open/4 and ssh_sftpd:handle_op/4. This issue affects OTP from OTP 17.0 until OTP 28.4.3, 27.3.4.11, and 26.2.5.20 corresponding to ssh from 3.01 until 5.5.3, 5.2.11.7, and 5.1.4.15.

An update of the erlang package has been released.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20907-1 advisory.

    This update for erlang fixes the following issues

    - CVE-2025-4748: improper limitation of a pathname may lead to path traversal (bsc#1244642).
    - CVE-2026-32147: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SFTP     chroot       (bsc#1262503).
    - CVE-2026-42789: `public_key` application accepts non-CA certificates as intermediate issuers and this     enables chain       forgery (bsc#1266449).
    - CVE-2026-42790: Name Constraints and Subject CommonName fallback in TLS hostname verification allows for     certificate       forgery by MITM attacker (bsc#1266466).
    - CVE-2026-42791: OCSP response verification in the `public_key` application does not check the validity     period of the       OCSP responder certificate and allows for OCSP response response forgery (bsc#1266448).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP     ssh (ssh_sftpd module) allows an authenticated SFTP user to modify file attributes outside the configured     chroot directory. The SFTP daemon (ssh_sftpd) stores the raw, user-supplied path in file handles instead     of the chroot-resolved path. When SSH_FXP_FSETSTAT is issued on such a handle, file attributes     (permissions, ownership, timestamps) are modified on the real filesystem path, bypassing the root     directory boundary entirely. Any authenticated SFTP user on a server configured with the root option can     modify file attributes of files outside the intended chroot boundary. The prerequisite is that a target     file must exist on the real filesystem at the same relative path. Note that this vulnerability only allows     modification of file attributes; file contents cannot be read or altered through this attack vector. If     the SSH daemon runs as root, this enables direct privilege escalation: an attacker can set the setuid bit     on any binary, change ownership of sensitive files, or make system configuration world-writable. This     vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines     ssh_sftpd:do_open/4 and ssh_sftpd:handle_op/4. This issue affects OTP from OTP 17.0 until OTP 28.4.3,     27.3.4.11, and 26.2.5.20 corresponding to ssh from 3.01 until 5.5.3, 5.2.11.7, and 5.1.4.15.
    (CVE-2026-32147)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
323235	Photon OS 4.0: Erlang PHSA-2026-4.0-1038	Nessus	PhotonOS Local Security Checks	high
320423	openSUSE 16 Security Update : erlang (openSUSE-SU-2026:20907-1)	Nessus	SuSE Local Security Checks	high
309710	Linux Distros Unpatched Vulnerability : CVE-2026-32147	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-32147

medium

Tenable Plugins

high

high

medium