CVE-2026-66835: httpd mod_auth directory protection bypassed by a doubled slash in the request path
httpd modauth directory protection bypassed by a doubled slash in the request path
Other sources
Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by prefixing the request path with an extra slash.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.2.5.21-6 - Upgrade
Upgrade
debian/erlangto a version that resolves this vulnerability.Fixed in 1:29.0.6+dfsg-1Fixed in 1:29.1.1+dfsg-1 - Upgrade
Upgrade
Erlang/OTPto a version that resolves this vulnerability.Fixed in 27.3.4.17 - Upgrade
Upgrade
Erlang/OTPto a version that resolves this vulnerability.Fixed in 28.5.0.6 - Upgrade
Upgrade
Erlang/OTPto a version that resolves this vulnerability.Fixed in 29.0.6
Event History
Frequently Asked Questions
Which deployments are exposed?
Erlang/OTP inets httpd deployments that use mod_auth to protect directory blocks are exposed when running OTP 17.0 before 27.3.4.17, OTP 28.0 before 28.5.0.6, or OTP 29.0 before 29.0.6.
What does an attacker need to exploit this issue?
An attacker only needs remote unauthenticated access to the httpd service and knowledge of a path within a mod_auth-protected directory. They can prefix the request path with an extra slash so that authorization checks treat it as unprotected while the operating system resolves it to the protected file.
Does this affect mod_security controls as well?
Yes. The same path mismatch can evade mod_security per-path accounting, because the doubled-slash path used during accounting differs from the path ultimately opened by the operating system.
What is the remediation?
Upgrade to OTP 27.3.4.17 or later in the OTP 27 series, OTP 28.5.0.6 or later in the OTP 28 series, or OTP 29.0.6 or later in the OTP 29 series.