CVE-2026-28808

ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)

State: Published
Severity: 8.3 High
Published: Apr 7, 2026
Updated: Sep 22, 2026
Reserved: Mar 3, 2026

Description

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.

When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.

This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.

This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Scores

CVSS	Score	Vector	Source
4.0	8.3 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N	EEF
3.1	7.4 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	redhat-SADP

Weaknesses

CWE-863 Incorrect Authorization
CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Affected Products

Product	Versions
OTPErlang	17.0 and laterAffectedfrom 26.2.5.19Not affectedfrom 27.3.4.10Not affectedfrom 28.4.2Not affected
OTPErlang	5.10 and laterAffectedfrom 9.1.0.6Not affectedfrom 9.3.2.4Not affectedfrom 9.6.2Not affected
OTPErlang	07b8f441ca711f9812fad9e9115bab3c3aa92f79 and laterAffectedfrom 8fc71ac6af4fbcc54103bec2983ef22e82942688Not affectedfrom 9dfa0c51eac97866078e808dec2183cb7871ff7cNot affected

References

GitHub Advisoryrelatedvendor-advisory
EEF CNA record for CVE-2026-28808related
OSV record EEF-CVE-2026-28808related
Erlang/OTP version ordering
Introducing commit 07b8f44 in erlang/otprelated
Fix commit 8fc71ac in erlang/otppatch
Fix commit 9dfa0c5 in erlang/otppatch
https://access.redhat.com/security/cve/CVE-2026-28808vdb-entry
RHBZ#2455909issue-tracking
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28808.json

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.