PT-2026-30814 · Erlang · Erlang/Otp

Konrad Pietrzak · Published 2026-04-07 · Updated 2026-04-22 · CVE-2026-28808

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Erlang OTP versions 17.0 through 28.4.2, 26.2.5.19, and 27.3.4.10

Description An incorrect authorization issue exists in Erlang OTP (inets modules) that allows unauthenticated access to CGI scripts protected by directory rules when served via script alias. This occurs because mod auth evaluates directory-based access controls against the DocumentRoot-relative path, while mod cgi executes scripts at the ScriptAlias-resolved path, creating a path mismatch. The affected program files are lib/inets/src/http server/mod alias.erl, lib/inets/src/http server/mod auth.erl, and lib/inets/src/http server/mod cgi.erl.

Recommendations Move CGI scripts inside DocumentRoot and use alias instead of script alias to ensure mod auth resolves the correct path. Apply URL-based access controls at a reverse proxy layer to block unauthenticated access to the script alias URL prefix. Remove mod cgi from the httpd modules chain if CGI functionality is not required.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-28808

GHSA-3VHP-H532-MC3F

OPENSUSE-SU-2026:20607-1

Affected Products

Erlang/Otp

References · 29

• https://github.com/erlang/otp/security/advisories/GHSA-3vhp-h532-mc3f · Vendor Advisory
• https://github.com/erlang/otp/commit/8fc71ac6af4fbcc54103bec2983ef22e82942688 · Patch
• https://github.com/erlang/otp/commit/9dfa0c51eac97866078e808dec2183cb7871ff7c · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-28808 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-28808 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20607-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-28808 · Vendor Advisory
• https://cna.erlef.org/cves/CVE-2026-28808.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-28808 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-28808 · Security Note
• https://ubuntu.com/security/CVE-2026-28808 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-21620 · Note
• https://suse.com/security/cve/CVE-2026-32144 · Note
• https://bugzilla.suse.com/1261734 · Note
• https://suse.com/security/cve/CVE-2026-23942 · Note