Path Equivalence Vulnerability in Erlang/OTP inets httpd

CVE-2026-66835

What is CVE-2026-66835?

The path equivalence vulnerability in Erlang/OTP inets httpd allows a remote attacker to bypass authentication and access files within a protected directory. By prefixing the request path with an extra slash, the authentication mechanism fails to recognize the directory as protected, leading to unauthorized exposure of sensitive files. This occurs due to improper normalization of the request URI, specifically the handling of empty path segments, ultimately undermining the intended security framework of mod_auth.

References