Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-48858— ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks

Quick assessment

Affected
Erlang OTP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Erlang/OTP是Erlang/OTP开源的一个JavaScript编写的处理处理异常的库。该库可以捕捉node.js内置API引发的异常。 Erlang/OTP inets 5.10.4至7.0之前版本和ftp 1.0至1.2.6之前版本、1.2.4.1版本和1.2.3.1版本存在代码问题漏洞，该漏洞源于ftp_internal模块PASV处理程序未验证服务器227响应中的IP地址，直接将IP地址传递给gen_tcp:connect/4，可能导致FTP反弹攻击和服务端请求伪造。

CVSS 6.3 · Medium EPSS 0.23% · P13

Affected Version Matrix 4

VendorProduct Version RangeStatus
Erlang OTP 5.10.4< 7.0 affected
1.0< * affected
17.4< * affected
be95772ee1fcfe71045ef070130bea7a910b81e3< * affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-48858

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks
Source: CVE Program / CVE List V5
Vulnerability Description
Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address. The ftp_internal:handle_ctrl_result/2 PASV handler (mode=passive, ipfamily=inet, ftp_extension=false) extracts the IP address from the server's 227 response and passes it directly to gen_tcp:connect/4 without validating it against the control connection peer address. The adjacent EPSV handlers correctly call peername(CSock) to derive the IP from the control connection, but the PASV handler does not. A malicious or compromised FTP server can redirect the client's data connection to an arbitrary internal host and port. On read operations (ftp:ls/1,2, ftp:nlist/1,2, ftp:recv/2,3), data from the redirected target is returned to the caller. On write operations (ftp:send/2,3, ftp:append/2,3), file content is sent to the redirected target. This enables SSRF against internal hosts, cloud metadata endpoints, and FTP bounce attacks against third-party hosts. The vulnerable path is the default configuration (mode=passive, ipfamily=inet, ftp_extension=false). RFC 2577 section 3 explicitly recommends validating the PASV response IP against the control connection peer. The ftp application is deprecated and scheduled for removal in OTP-30. This vulnerability is associated with program files lib/inets/src/ftp/ftp_internal.erl (inets 5.10.4 through 6.5, OTP 17.4 through 20.3) and lib/ftp/src/ftp_internal.erl (ftp 1.0 and later, OTP 21.0 and later). This issue affects OTP from OTP 17.4 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to inets from 5.10.4 before 7.0 and ftp from 1.0 before 1.2.6, 1.2.4.1 and 1.2.3.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
Erlang/OTP 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Erlang/OTP是Erlang/OTP开源的一个JavaScript编写的处理处理异常的库。该库可以捕捉node.js内置API引发的异常。 Erlang/OTP inets 5.10.4至7.0之前版本和ftp 1.0至1.2.6之前版本、1.2.4.1版本和1.2.3.1版本存在代码问题漏洞，该漏洞源于ftp_internal模块PASV处理程序未验证服务器227响应中的IP地址，直接将IP地址传递给gen_tcp:connect/4，可能导致FTP反弹攻击和服务端请求伪造。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Erlang OTP 5.10.4 ~ 7.0 cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Erlang OTP 1.0 ~ * cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Erlang OTP 17.4 ~ * cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-48858

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-48858

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-48858 (2)

Vendor Advisories for CVE-2026-48858 (3)

Same Patch Batch · Erlang · 2026-06-10 · 7 CVEs total

CVE-2026-49759 8.8 HIGH Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash
CVE-2026-48860 7.5 HIGH Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion i
CVE-2026-48856 7.1 HIGH httpc leaks Authorization header to cross-origin redirect targets
CVE-2026-49760 6.9 MEDIUM Stack Buffer Overflow in ei_s_print_term at Very Large Integer
CVE-2026-48859 6.3 MEDIUM SSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated usernam
CVE-2026-48855 2.3 LOW SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured

IV. Related Vulnerabilities

Same product: OTP
Same vendor: Erlang
Same weakness: CWE-918

V. Comments for CVE-2026-48858

No comments yet

Leave a comment