Relative Path Traversal Vulnerability in Erlang OTP TFTP Modules
CVE-2026-21620

2.3LOW

Key Information:

Vendor

Erlang

Status
Otp
Vendor
CVE Published:
20 February 2026

What is CVE-2026-21620?

A vulnerability exists in the TFTP file modules of Erlang OTP, allowing attackers to exploit relative path traversal. This flaw enables unauthorized access to files and directories outside the intended scope, potentially leading to data leakage or other malicious actions. The issue lies within the program files located in lib/tftp/src/tftp_file.erl, presenting risk in multiple versions of Erlang OTP. Updating to the latest patched versions is strongly recommended to mitigate this risk.

Affected Version(s)

OTP 17.0

OTP 07b8f441ca711f9812fad9e9115bab3c3aa92f79

OTP 5.10 < 7.0

References

https://github.com/erlang/otp/security/advisories/GHSA-hm...
vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-21620.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-21620
related

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Luigino Camastra
Jakub Witczak
Raimo Niskanen
.