Log in Start free

Vulnerability · Published Apr 7, 2026 · Assigned by EEF

CVE-2026-28808ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)

High 7.4

In plain English

A high-severity incorrect authorization in OTP from Erlang. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.6%top 52.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect. This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl. This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12erlangno fix listedDEBIAN-CVE-2026-28808
Debian:13erlang1:27.3.4.1+dfsg-1+deb13u3DEBIAN-CVE-2026-28808
Debian:14erlang1:27.3.4.10+dfsg-1DEBIAN-CVE-2026-28808
Ubuntu:22.04:LTSerlang1:24.2.1+dfsg-1ubuntu0.8USN-8901-1
Ubuntu:22.04:LTSerlang1:24.2.1+dfsg-1ubuntu0.8UBUNTU-CVE-2026-28808
Ubuntu:24.04:LTSerlang1:25.3.2.8+dfsg-1ubuntu4.8USN-8901-1
Ubuntu:24.04:LTSerlang1:25.3.2.8+dfsg-1ubuntu4.8UBUNTU-CVE-2026-28808
Ubuntu:25.10erlangno fix listedUBUNTU-CVE-2026-28808
Ubuntu:26.04:LTSerlang1:27.3.4.6+dfsg-1ubuntu0.2UBUNTU-CVE-2026-28808
Ubuntu:26.04:LTSerlang1:27.3.4.6+dfsg-1ubuntu0.2USN-8901-1

Affected products (as reported)

VendorProductVersions
Erlang OTP 17.0 – before *
Erlang OTP 5.10 – before *
Erlang OTP 07b8f441ca711f9812fad9e9115bab3c3aa92f79 – before *

Weakness: CWE-863, CWE-551 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References