Log in Start free

Vulnerability · Published Feb 20, 2026 · Assigned by EEF

CVE-2026-21620TFTP Path Traversal

Low 2.3

In plain English

A low-severity security flaw in OTP from Erlang. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.3Low
Exploit odds (30 days)0.5%top 55.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl. This issue affects OTP from OTP 17.0 before OTP 28.3.2, OTP 27.3.4.8 and OTP 26.2.5.17, corresponding to tftp from 1.0 before 1.2.4, 1.2.2.1 and 1.1.1.1; also inets from 5.10 before 7.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12erlang1:25.2.3+dfsg-1+deb12u4DEBIAN-CVE-2026-21620
Debian:13erlang1:27.3.4.1+dfsg-1+deb13u2DEBIAN-CVE-2026-21620
Debian:14erlang1:27.3.4.8+dfsg-1DEBIAN-CVE-2026-21620
Ubuntu:22.04:LTSerlang1:24.2.1+dfsg-1ubuntu0.8USN-8901-1
Ubuntu:22.04:LTSerlang1:24.2.1+dfsg-1ubuntu0.8UBUNTU-CVE-2026-21620
Ubuntu:24.04:LTSerlang1:25.3.2.8+dfsg-1ubuntu4.8USN-8901-1
Ubuntu:24.04:LTSerlang1:25.3.2.8+dfsg-1ubuntu4.8UBUNTU-CVE-2026-21620
Ubuntu:25.10erlangno fix listedUBUNTU-CVE-2026-21620
Ubuntu:26.04:LTSerlang1:27.3.4.6+dfsg-1ubuntu0.2UBUNTU-CVE-2026-21620
Ubuntu:26.04:LTSerlang1:27.3.4.6+dfsg-1ubuntu0.2USN-8901-1

Affected products (as reported)

VendorProductVersions
Erlang OTP 17.0 – before *07b8f441ca711f9812fad9e9115bab3c3aa92f79 – before *
Erlang OTP 5.10 – before 7.0
Erlang OTP 1.0 – before *

Weakness: CWE-23 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References