CVE-2026-21620 — Relative Path Traversal in OTP

CWE-23 — Relative Path TraversalCWE-22 — Path Traversal7 documents7 sources
Severity
2.3LOWNVD
EPSS
0.0%
top 92.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Erlang OTP
Timeline
PublishedFeb 20

Description

Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl. This issue affects otp: from 17.0, from 07b8f441ca711f9812fad9e9115bab3c3aa92f79; otp: from 5.10 before 7.0; otp: from 1.0.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages1 packages

▶CVEListV5erlang/otp17.0 — *+3

🔴Vulnerability Details

2
CVEList
TFTP Path Traversal↗2026-02-20
▶
OSV
CVE-2026-21620: Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp↗2026-02-20
▶

📋Vendor Advisories

3
Red Hat
erlang: Erlang OTP tftp_file modules: Information disclosure via relative path traversal↗2026-02-20
▶
Microsoft
TFTP Path Traversal↗2026-02-10
▶
Debian
CVE-2026-21620: erlang - Relative Path Traversal, Improper Isolation or Compartmentalization vulnerabilit...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-21620 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-21620 — Relative Path Traversal in Erlang OTP | cvebase