Skip to content
Fencer Vulns
medium 6.5

CVE-2026-48858 json

ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks

published 2026-06-10 4 mo ago modified 2026-10-25 14 d ago also EUVD-2026-36055

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 14%
public exploits
0
none known

Summary

Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address.

The ftp_internal:handle_ctrl_result/2 PASV handler (mode=passive, ipfamily=inet, ftp_extension=false) extracts the IP address from the server's 227 response and passes it directly to gen_tcp:connect/4 without validating it against the control connection peer address. The adjacent EPSV handlers correctly call peername(CSock) to derive the IP from the control connection, but the PASV handler does not. A malicious or compromised FTP server can redirect the client's data connection to an arbitrary internal host and port. On read operations (ftp:ls/1,2, ftp:nlist/1,2, ftp:recv/2,3), data from the redirected target is returned to the caller. On write operations (ftp:send/2,3, ftp:append/2,3), file content is sent to the redirected target. This enables SSRF against internal hosts, cloud metadata endpoints, and FTP bounce attacks against third-party hosts.

The vulnerable path is the default configuration (mode=passive, ipfamily=inet, ftp_extension=false). RFC 2577 section 3 explicitly recommends validating the PASV response IP against the control connection peer.

The ftp application is deprecated and scheduled for removal in OTP-30.

This vulnerability is associated with program files lib/inets/src/ftp/ftp_internal.erl (inets 5.10.4 through 6.5, OTP 17.4 through 20.3) and lib/ftp/src/ftp_internal.erl (ftp 1.0 and later, OTP 21.0 and later).

This issue affects OTP from OTP 17.4 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to inets from 5.10.4 before 7.0 and ftp from 1.0 before 1.2.6, 1.2.4.1 and 1.2.3.1.

Patch / fix

  • Erlang OTP 1.2.3.1, 1.2.4.1, 1.2.6, 7.0, 27.3.4.13, 28.5.0.2, 29.0.2
  • erlang Debian 13 1:27.3.4.1+dfsg-1+deb13u3
  • erlang Debian 14 1:29.0.2+dfsg-1

debian advisories DEBIAN-CVE-2026-48858

  • erlang Ubuntu 22.04 LTS 1:24.2.1+dfsg-1ubuntu0.8
  • erlang Ubuntu 24.04 LTS 1:25.3.2.8+dfsg-1ubuntu4.8
  • erlang Ubuntu 26.04 LTS 1:27.3.4.6+dfsg-1ubuntu0.2
  • erlang Ubuntu Pro 14.04 LTS 1:16.b.3-dfsg-1ubuntu2.2+esm3
  • erlang Ubuntu Pro 16.04 LTS 1:18.3-dfsg-1ubuntu3.1+esm4
  • erlang Ubuntu Pro 18.04 LTS 1:20.2.2+dfsg-1ubuntu2+esm4
  • erlang Ubuntu Pro 20.04 LTS 1:22.2.7+dfsg-1ubuntu0.5+esm3

ubuntu advisories UBUNTU-CVE-2026-48858

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • erlang27 hummingbird 1 27.3.4.17-1.hum1
  • erlang27-et hummingbird 1 27.3.4.17-1.hum1
  • erlang27-wx hummingbird 1 27.3.4.17-1.hum1
  • erlang27-ftp hummingbird 1 27.3.4.17-1.hum1
  • erlang27-ssh hummingbird 1 27.3.4.17-1.hum1
  • erlang27-ssl hummingbird 1 27.3.4.17-1.hum1
  • erlang27-asn1 hummingbird 1 27.3.4.17-1.hum1
  • erlang27-edoc hummingbird 1 27.3.4.17-1.hum1

red hat advisories RHSA-2026:63160

  • erlang SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 23.3.4.19-150300.3.39.1
  • erlang26 SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Server Applications 15 SP7 26.2.1-150300.7.28.1

suse advisories SUSE-SU-2026:3645-1SUSE-SU-2026:3579-1

  • erlang openSUSE Tumbleweed 28.5.0.4-1.1
  • erlang27 openSUSE Tumbleweed 27.1.3-3.1

opensuse advisories openSUSE-SU-2026:11559-1openSUSE-SU-2026:11560-1

  • erlang Azure Linux 3.0 26.2.5.21-2

azure linux advisories AZL-90117

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-48858 updated cvss 6.5

erlang: erlang-inets: erlang-ftp: Erlang/OTP ftp: Server-Side Request Forgery (SSRF) via unvalidated PASV response IP address

  • Red Hat OpenStack Platform 16.2 erlang, erlang-ssl, erlang-asn1, erlang-erts, erlang-hipe, erlang-sasl, +15 more Red Hat OpenStack Platform 17.1 erlang, erlang-ssl, erlang-asn1, erlang-erts, erlang-sasl, erlang-snmp, +14 more Red Hat OpenStack Platform 18.0 erlang
    under investigation
  • Red Hat Hardened Images erlang27 27.3.4.17-1.hum1, erlang27-et 27.3.4.17-1.hum1, erlang27-wx 27.3.4.17-1.hum1, erlang27-ftp 27.3.4.17-1.hum1, erlang27-ssh 27.3.4.17-1.hum1, erlang27-ssl 27.3.4.17-1.hum1, +33 more
    fixed: vendor fix RHSA-2026:63160

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

  • Erlang OTP

Classification

Weakness
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.