CVE-2026-21620: TFTP Path Traversal
Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftpfile modules), erlang otp inets (tftpfile modules), erlang otp tftp (tftpfile modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftpfile.erl, src/tftpfile.erl.
This issue affects OTP from OTP 17.0 before OTP 28.3.2, OTP 27.3.4.8 and OTP 26.2.5.17, corresponding to tftp from 1.0 before 1.2.4, 1.2.2.1 and 1.1.1.1; also inets from 5.10 before 7.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21620?
The severity of CVE-2026-21620 is classified as a high-risk vulnerability due to its potential for unauthorized access through relative path traversal.
How do I fix CVE-2026-21620?
To fix CVE-2026-21620, update to the latest version of the Erlang/OTP framework that addresses this vulnerability.
Which versions of Erlang/OTP are affected by CVE-2026-21620?
CVE-2026-21620 affects Erlang/OTP versions from 1.0 up to and including 7.0, as well as version 17.0 and later.
What impact does CVE-2026-21620 have on TFTP functionality?
CVE-2026-21620 allows attackers to perform a relative path traversal, potentially enabling them to access sensitive files on the server through TFTP functionality.
Is CVE-2026-21620 specific to certain modules of Erlang/OTP?
Yes, CVE-2026-21620 specifically involves vulnerabilities in the TFTP file modules of Erlang/OTP.