CVE-2026-21620

UNKNOWN 0.0

TFTP Path Traversal

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

8th

Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl. This issue affects otp: from 17.0, from 07b8f441ca711f9812fad9e9115bab3c3aa92f79; otp: from 5.10 before 7.0; otp: from 1.0.

CWE	CWE-23
Vendor	erlang
Product	otp
Published	Feb 20, 2026
Last Updated	Apr 7, 2026

Stay Ahead of the Next One

Get instant alerts for erlang otp

Be the first to know when new unknown vulnerabilities affecting erlang otp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Erlang / OTP

17.0 < * 07b8f441ca711f9812fad9e9115bab3c3aa92f79 < *

Erlang / OTP

5.10 < 7.0

Erlang / OTP

1.0 < *

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/erlang/otp/security/advisories/GHSA-hmrc-prh3-rpvp cna.erlef.org: https://cna.erlef.org/cves/CVE-2026-21620.html osv.dev: https://osv.dev/vulnerability/EEF-CVE-2026-21620 erlang.org: https://www.erlang.org/doc/system/versions.html#order-of-versions github.com: https://github.com/erlang/otp/pull/10706 github.com: https://github.com/erlang/otp/commit/696fdec922661d4a3cc528fc34bc24fae8d4ad8a github.com: https://github.com/erlang/otp/commit/3970738f687325138eb75f798054fa8960ac354e github.com: https://github.com/erlang/otp/commit/655fb95725ba2fb811740b57e106873833824344

Credits

🔍 Luigino Camastra Jakub Witczak Raimo Niskanen