CVE-2026-21620 · published 2026-02-20 · updated 2026-11-11

TFTP Path Traversal

LOW 2.3 CWE-23 · Relative Path Traversal
OSV.dev JSON

Am I affected?

type your erlang.org/otp version to check

Description

Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal.

This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl.

This issue affects OTP from OTP 17.0 before OTP 26.2.5.17, OTP 27.3.4.8, and OTP 28.3.2, corresponding to inets from 5.10 before 7.0, and tftp from 1.0 before 1.1.1.1, 1.2.2.1, and 1.2.4.

Weaknesses & attack patterns

Weakness

CWE-23 · Relative Path Traversal in catalog → MITRE ↗

Attack patterns

CAPEC-139 · Relative Path Traversal MITRE ↗

Affected — Erlang

≥ 17.0 and up affected
→ 26.2.5.17 not affected
→ 27.3.4.8 not affected
→ 28.3.2 not affected
every other version: unaffected
cpe cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:*
version type otp
modules · source files
modules tftp_file
source files lib/inets/src/tftp/tftp_file.erl · lib/tftp/src/tftp_file.erl

Affected — Erlang / inets Repository ↗

≥ 5.10 < 7.0 affected
every other version: unaffected
cpe cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:*
version type otp
modules · source files
modules tftp_file
source files src/tftp/tftp_file.erl

Affected — Erlang / tftp Repository ↗

≥ 1.0 and up affected
→ 1.1.1.1 not affected
→ 1.2.2.1 not affected
→ 1.2.4 not affected
every other version: unaffected
cpe cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:*
version type otp
modules · source files
modules tftp_file
source files src/tftp_file.erl

Affected — GitHub / erlang/otp Repository ↗

≥ 07b8f44 and up affected
→ 655fb95 not affected
→ 3970738 not affected
→ 696fdec not affected
every other version: unaffected
cpe cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:*
version type git
modules · source files
modules tftp_file
source files lib/inets/src/tftp/tftp_file.erl · lib/tftp/src/tftp_file.erl

Configurations

A TFTP server must be started and the TFTP port must be reachable by the attacker, using the tftp application (or the legacy inets TFTP service) with the tftp_file callback module configured with the {root_dir, Dir} option.

References

TFTP Path Traversal (github.com) vendor-advisory
https://github.com/erlang/otp/pull/10706 patch
Fix commit 655fb95 in erlang/otp (github.com) patch
Fix commit 3970738 in erlang/otp (github.com) patch
Fix commit 696fdec in erlang/otp (github.com) patch
OSV record EEF-CVE-2026-21620 (osv.dev) related
Introducing commit 07b8f44 in erlang/otp (github.com) related

Credits

Luigino Camastra / Aisle Research Finder
Jakub Witczak Remediation reviewer
Raimo Niskanen Remediation developer

CVSS breakdown

LOW 2.3 open in calculator →
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
« All CVEs