CVE-2026-21620: erlang otp Relative Path Traversal

CVSS: 2.3v4.0LowDeferred

AliasesUBUNTU-CVE-2026-21620DEBIAN-CVE-2026-21620

Published 20-02-2026Last modified 24-07-2026

Vulnerability summary

CVE-2026-21620 is a low (CVSS 2.3) Relative Path Traversal vulnerability in erlang otp. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43.1% of scored vulnerabilities.

Overall risk

9/100

0100

Minimal · default modelHow is this calculated?

CVSS score

2.3/10

010

Low · v4.0 (CVE.org)

EPSS score

0.52%

0%100%

Low · +0.06 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 3

OPENSUSE-SU-2026:10947-1 OPENSUSE-SU-2026:20607-1 USN-8901-1

Timeline

20-02-2026
PublishedVulnerability first disclosed.
24-07-2026
Last modifiedVulnerability information updated.

Description

Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl. This issue affects OTP from OTP 17.0 before OTP 28.3.2, OTP 27.3.4.8 and OTP 26.2.5.17, corresponding to tftp from 1.0 before 1.2.4, 1.2.2.1 and 1.1.1.1; also inets from 5.10 before 7.0.

CVSS metrics

4 scores · 4 sources · 1 version

v4.02.3

EPSS trend

Probability

0.52%

Chance of exploitation in the next 30 days

Percentile

43%

Versus all other CVEs

30-day change

+0.06 pp

From 0.46% on 18-09-2026

18-09-202618-10-2026

EPSS score

0.52%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-23Relative Path TraversalThe product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Affected systems

Debian1 product

erlang< 1:25.2.3+dfsg-1+deb12u4 | < 1:27.3.4.1+dfsg-1+deb13u2 | < 1:27.3.4.8+dfsg-1

Erlang1 product

otp≥ 17.0 (No fix recorded) | ≥ 07b8f441ca711f9812fad9e9115bab3c3aa92f79 (No fix recorded) | ≥ 5.10, < 7.0 | ≥ 1.0 (No fix recorded)

Ubuntu1 product

erlang< 1:16.b.3-dfsg-1ubuntu2.2+esm3 | < 1:18.3-dfsg-1ubuntu3.1+esm4 | < 1:20.2.2+dfsg-1ubuntu2+esm4 | < 1:22.2.7+dfsg-1ubuntu0.5+esm3 | < 1:24.2.1+dfsg-1ubuntu0.8 | < 1:25.3.2.8+dfsg-1ubuntu4.8 | All versions (No fix recorded) | < 1:27.3.4.6+dfsg-1ubuntu0.2

3 vendors · 3 products