Linuxsecurity SUSE and openSUSE Address Erlang Path Traversal Vulnerability
Article Content
- •CVE-2026-32147 affects SUSE and openSUSE systems with a CVSS score of 4.0.
- •The vulnerability allows path traversal in SFTP chroot, risking unauthorized file access.
- •Patches are available and should be applied immediately to affected systems.
A moderate path traversal vulnerability (CVE-2026-32147) has been identified in Erlang affecting SUSE and openSUSE systems. This vulnerability allows improper limitation of a pathname to a restricted directory in SFTP chroot, potentially enabling unauthorized access to sensitive files. The affected systems include SUSE Linux Enterprise Server 15 SP7 and openSUSE Leap 15.3. Users are advised to apply the provided patches immediately to mitigate risks. The vulnerability was published on April 21, 2026, and has a CVSS score of 4.0. Patch instructions are available through standard SUSE installation methods. The vulnerability is not currently reported to be actively exploited. Administrators should prioritize updating their systems to maintain security.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track OpenSUSE and CVE-2026-32147 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. These vulnerabilities are being by Chinese actors for cyber espionage, targeting… 
Path Traversal Vulnerability in WinRAR Exploited by RomCom Group CVE-2025-8088 is a path traversal vulnerability in WinRAR versions up to 7.12, allowing attackers to exploit alternate data streams (ADSes) in RAR files to extract malicious payloads to sensitive system locations. Exploitation began in the wild on July 18, 2025, with attackers linked to the Russia-aligned RomCom…