FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Erlang/OTP -- SFTP READLINK discloses server filesystem paths

Affected packages
	erlang-runtime27	<	27.3.4.13
	erlang-runtime28	<	28.5.0.2
	erlang-runtime29	<	29.0.2

Details

VuXML ID	d87e41a4-64d4-11f1-ab11-4c526214c986
Discovery	2026-06-10
Entry	2026-06-10

https://github.com/erlang/otp/security/advisories/GHSA-pv7g-pjrq-x2fh reports:

The SSH SFTP daemon's handling of SSH_FXP_READLINK returned symbolic link targets containing the server's absolute filesystem path, disclosing the backend root prefix to clients. The handler now strips the backend root prefix from symlink targets before returning them.

[source]

References

CVE Name	CVE-2026-48855
URL	https://github.com/erlang/otp/security/advisories/GHSA-pv7g-pjrq-x2fh