PT-2026-21008 · Tftp+2 · Tftp+2

Jakub Witczak + 2 · Published 2026-02-20 · Updated 2026-04-22 · CVE-2026-21620

Positive Technologies (AI Summary)

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions erlang otp versions 1.0 through 6.9 erlang otp version 17.0 erlang otp versions prior to 7.0

Description The software contains a Relative Path Traversal and Improper Isolation or Compartmentalization issue. The issue is associated with program files lib/tftp/src/tftp file.erl and src/tftp file.erl. The vulnerability affects the tftp file modules within erlang/otp, inets, and tftp.

Recommendations erlang otp versions 1.0 through 6.9: At the moment, there is no information about a newer version that contains a fix for this vulnerability. erlang otp version 17.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. erlang otp versions prior to 7.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

AZL-78278

AZL-78285

CVE-2026-21620

GHSA-HMRC-PRH3-RPVP

OPENSUSE-SU-2026:20607-1

SUSE-SU-2026:1714-1

SUSE-SU-2026:2010-1

SUSE-SU-2026:21374-1

Affected Products

Erlang/Otp

Inets

Tftp

References · 39

• https://github.com/erlang/otp/pull/10706 · Patch
• https://github.com/erlang/otp/security/advisories/GHSA-hmrc-prh3-rpvp · Vendor Advisory
• https://github.com/erlang/otp/commit/3970738f687325138eb75f798054fa8960ac354e · Patch
• https://github.com/erlang/otp/commit/696fdec922661d4a3cc528fc34bc24fae8d4ad8a · Patch
• https://github.com/erlang/otp/commit/655fb95725ba2fb811740b57e106873833824344 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-21620 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-78278 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21620 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-21620 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:20607-1 · Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-21620 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-78285 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21620 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-21620 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-21620 · Vendor Advisory