Riskcovery

CVE-2026-21620

TFTP Path Traversal

State
Published
Severity
2.3 Low
Published
Feb 20, 2026
Updated
Jul 24, 2026
Reserved
Jan 1, 2026

Read the record on cve.org

Description

Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl.

This issue affects OTP from OTP 17.0 before OTP 28.3.2, OTP 27.3.4.8 and OTP 26.2.5.17, corresponding to tftp from 1.0 before 1.2.4, 1.2.2.1 and 1.1.1.1; also inets from 5.10 before 7.0.

Scores

CVSSScoreVectorSource
4.02.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:NEEF

Weaknesses

  • CWE-23 Relative Path Traversal

Affected Products

ProductVersions
OTPErlang
  • 17.0 and laterAffectedfrom 26.2.5.17Not affectedfrom 27.3.4.8Not affectedfrom 28.3.2Not affected
  • 07b8f441ca711f9812fad9e9115bab3c3aa92f79 and laterAffectedfrom 655fb95725ba2fb811740b57e106873833824344Not affectedfrom 3970738f687325138eb75f798054fa8960ac354eNot affectedfrom 696fdec922661d4a3cc528fc34bc24fae8d4ad8aNot affected
OTPErlang
  • 5.10 to before 7.0Affected
OTPErlang
  • 1.0 and laterAffectedfrom 1.1.1.1Not affectedfrom 1.2.2.1Not affectedfrom 1.2.4Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.