CVE-2026-21620

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-21620
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21620.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-21620
Aliases
Downstream
AZL (2)
DEBIAN (1)
OESA (3)
openSUSE (2)
SUSE (3)
UBUNTU (1)
Related
openSUSE (2)
SUSE (3)
Published
2026-02-20T10:57:08Z
Modified
2026-11-12T10:45:34Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
TFTP Path Traversal
Details

Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal.

This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl.

This issue affects OTP from OTP 17.0 before OTP 26.2.5.17, OTP 27.3.4.8, and OTP 28.3.2, corresponding to inets from 5.10 before 7.0, and tftp from 1.0 before 1.1.1.1, 1.2.2.1, and 1.2.4.

Database specific 
{
    "cna_assigner": "EEF",
    "cwe_ids": [
        "CWE-23"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21620.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "1.0"
                        },
                        {
                            "fixed": "1.1.1.1"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "ChangesAt"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "5.10"
                        },
                        {
                            "fixed": "7.0"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/erlang/otp

Affected ranges

Type
GIT
Repo
https://github.com/erlang/otp
Events
Introduced
07b8f441ca711f9812fad9e9115bab3c3aa92f79
Fixed
655fb95725ba2fb811740b57e106873833824344
Fixed
3532818e19647ae5675396eb501400783e5ca693
Fixed
07b8f441ca711f9812fad9e9115bab3c3aa92f79
Fixed
3970738f687325138eb75f798054fa8960ac354e
Fixed
696fdec922661d4a3cc528fc34bc24fae8d4ad8a
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "07b8f441ca711f9812fad9e9115bab3c3aa92f79"
                },
                {
                    "fixed": "655fb95725ba2fb811740b57e106873833824344"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "ChangesAt"
        },
        {
            "range": [
                {
                    "introduced": "17.0"
                },
                {
                    "fixed": "26.2.5.17"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "ChangesAt"
        },
        {
            "range": [
                {
                    "fixed": "07b8f441ca711f9812fad9e9115bab3c3aa92f79"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "655fb95725ba2fb811740b57e106873833824344"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "3970738f687325138eb75f798054fa8960ac354e"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "696fdec922661d4a3cc528fc34bc24fae8d4ad8a"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21620.json"