2.3

CVE-2026-21620

TFTP Path Traversal

Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl.

This issue affects otp: from 17.0, from 07b8f441ca711f9812fad9e9115bab3c3aa92f79; otp: from 5.10 before 7.0; otp: from 1.0.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerErlang
≫
Produkt OTP
Default Statusunaffected
Version 17.0
Version < *
Status affected
Version 07b8f441ca711f9812fad9e9115bab3c3aa92f79
Version < *
Status affected
HerstellerErlang
≫
Produkt OTP
Default Statusunaffected
Version 5.10
Version < 7.0
Status affected
HerstellerErlang
≫
Produkt OTP
Default Statusunaffected
Version 1.0
Version < *
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.46% 0.364
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
6b3ad84c-e1a6-4bf7-a703-f496b71e49db 2.3 0 0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-23 Relative Path Traversal

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

https://www.erlang.org/doc/system/versions.html#order-of-versions
https://github.com/erlang/otp/commit/3970738f687325138eb75f798054fa8960ac354e
https://github.com/erlang/otp/commit/655fb95725ba2fb811740b57e106873833824344
https://github.com/erlang/otp/commit/696fdec922661d4a3cc528fc34bc24fae8d4ad8a
https://github.com/erlang/otp/pull/10706
https://github.com/erlang/otp/security/advisories/GHSA-hmrc-prh3-rpvp
https://cna.erlef.org/cves/CVE-2026-21620.html
https://osv.dev/vulnerability/EEF-CVE-2026-21620