Home

Description

Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl. This issue affects otp: from 17.0, from 07b8f441ca711f9812fad9e9115bab3c3aa92f79; otp: from 5.10 before 7.0; otp: from 1.0.

PUBLISHED Reserved 2026-01-01 | Published 2026-02-20 | Updated 2026-05-27 | Assigner EEF




LOW: 2.3CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-23 Relative Path Traversal

Product status

Default status
unaffected

17.0 (otp) before *
affected

07b8f441ca711f9812fad9e9115bab3c3aa92f79 (git) before *
affected

Default status
unaffected

5.10 (otp) before 7.0
affected

Default status
unaffected

1.0 (otp) before *
affected

Credits

Luigino Camastra / Aisle Research finder

Jakub Witczak remediation reviewer

Raimo Niskanen remediation developer

References

github.com/...ng/otp/security/advisories/GHSA-hmrc-prh3-rpvp vendor-advisory related

cna.erlef.org/cves/CVE-2026-21620.html related

osv.dev/vulnerability/EEF-CVE-2026-21620 related

www.erlang.org/doc/system/versions.html

github.com/erlang/otp/pull/10706 patch

github.com/...ommit/696fdec922661d4a3cc528fc34bc24fae8d4ad8a patch

github.com/...ommit/3970738f687325138eb75f798054fa8960ac354e patch

github.com/...ommit/655fb95725ba2fb811740b57e106873833824344 patch

cve.org (CVE-2026-21620)

nvd.nist.gov (CVE-2026-21620)

Download JSON