PT-2026-30814 · Erlang · Otp

Konrad Pietrzak · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-28808

Mitre

CVSS v4.0

8.3

High

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script alias.

When script alias maps a URL prefix to a directory outside DocumentRoot, mod auth evaluates directory-based access controls against the DocumentRoot-relative path while mod cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.

This vulnerability is associated with program files lib/inets/src/http server/mod alias.erl, lib/inets/src/http server/mod auth.erl, and lib/inets/src/http server/mod cgi.erl.

This issue affects OTP from OTP 17.0 until OTP 28.4.2, 27.3.4.10 and 26.2.5.19 corresponding to inets from 5.10 until 9.6.2, 9.3.2.4 and 9.1.0.6.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-28808

Affected Products

Otp

References · 7

• https://github.com/erlang/otp/commit/9dfa0c51eac97866078e808dec2183cb7871ff7c · Patch
• https://github.com/erlang/otp/commit/8fc71ac6af4fbcc54103bec2983ef22e82942688 · Patch
• https://github.com/erlang/otp/security/advisories/GHSA-3vhp-h532-mc3f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28808 · Security Note
• https://osv.dev/vulnerability/EEF-CVE-2026-28808 · Note
• https://erlang.org/doc/system/versions.html#order-of-versions · Note
• https://cna.erlef.org/cves/CVE-2026-28808.html · Note