CVE-2026-21620
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Erlang/OTP has a relative path traversal vulnerability in the tftp_file modules, allowing access to files outside the intended directory. This affects OTP versions from 17.0 before 28.3.2, 27.3.4.8, and 26.2.5.17.
Risk Assessment
The risk involves potential file read or write outside the intended directory by an attacker, which could lead to data leakage or system modification.
Recommendation
Update Erlang/OTP to version 28.3.2, 27.3.4.8, or 26.2.5.17 depending on the branch in use.
Original NVD description (English source)
Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl. This issue affects OTP from OTP 17.0 before OTP 28.3.2, OTP 27.3.4.8 and OTP 26.2.5.17, corresponding to tftp from 1.0 before 1.2.4, 1.2.2.1 and 1.1.1.1; also inets from 5.10 before 7.0.