Description
Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl. This issue affects OTP from OTP 17.0 before OTP 28.3.2, OTP 27.3.4.8 and OTP 26.2.5.17, corresponding to tftp from 1.0 before 1.2.4, 1.2.2.1 and 1.1.1.1; also inets from 5.10 before 7.0.
CVSS breakdown
CVSS 4.0
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
Low
User Interaction
None
Confidentiality (Vulnerable System)
Low
Integrity (Vulnerable System)
Low
Availability (Vulnerable System)
None
Confidentiality (Subsequent System)
None
Integrity (Subsequent System)
None
Availability (Subsequent System)
None
Affected products
- erlang / erlang/otp
- erlang / OTP5.10 – 7.0
- erlang / OTP1.0 – *
References
- VENDOR_ADVISORYhttps://github.com/erlang/otp/security/advisories/GHSA-hmrc-prh3-rpvp
- MISChttps://cna.erlef.org/cves/CVE-2026-21620.html
- MISChttps://osv.dev/vulnerability/EEF-CVE-2026-21620
- MISChttps://www.erlang.org/doc/system/versions.html#order-of-versions
- PATCHhttps://github.com/erlang/otp/pull/10706
- PATCHhttps://github.com/erlang/otp/commit/696fdec922661d4a3cc528fc34bc24fae8d4ad8a
- PATCHhttps://github.com/erlang/otp/commit/3970738f687325138eb75f798054fa8960ac354e
- PATCHhttps://github.com/erlang/otp/commit/655fb95725ba2fb811740b57e106873833824344
Updated 16m ago · 8 sources