DEBIAN-CVE-2026-28808

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-28808
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-28808.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-28808
Upstream
Published
2026-04-07T13:16:46Z
Modified
2026-09-09T08:47:28Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect. This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl. This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

References

Affected packages

Debian:12 / erlang

Package

Name
erlang
Purl
pkg:deb/debian/erlang?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1:25.*
1:25.2.3+dfsg-1
1:25.2.3+dfsg-1+deb12u1
1:25.2.3+dfsg-1+deb12u2
1:25.2.3+dfsg-1+deb12u3
1:25.2.3+dfsg-1+deb12u4
1:25.3.2.8+dfsg-1
1:25.3.2.10+dfsg-1
1:25.3.2.10+dfsg-2
1:25.3.2.11+dfsg-1
1:25.3.2.12+dfsg-1
1:25.3.2.12+dfsg-2
1:25.3.2.12+dfsg-3
1:26.*
1:26.0~rc2+dfsg-1
1:26.0~rc3+dfsg-1
1:26.0+dfsg-1
1:26.0.1+dfsg-1
1:26.0.2+dfsg-1
1:26.1.2+dfsg-1
1:26.2.1+dfsg-1
1:26.2.4+dfsg-1
1:27.*
1:27.0~rc3+dfsg-1
1:27.0~rc3+dfsg-2
1:27.0~rc3+dfsg-3
1:27.0~rc3+dfsg-4
1:27.0+dfsg-1
1:27.0.1+dfsg-1
1:27.0.1+dfsg-2
1:27.0.1+dfsg-3
1:27.1.2+dfsg-1
1:27.2+dfsg-1
1:27.2+dfsg-2
1:27.2+dfsg-3~exp1
1:27.2.1+dfsg-1
1:27.2.1+dfsg-2
1:27.2.2+dfsg-1
1:27.2.3+dfsg-1
1:27.2.4+dfsg-1
1:27.3+dfsg-1
1:27.3.1+dfsg-1
1:27.3.2+dfsg-1
1:27.3.3+dfsg-1
1:27.3.4+dfsg-1
1:27.3.4.1+dfsg-1
1:27.3.4.3+dfsg-1
1:27.3.4.4+dfsg-1
1:27.3.4.6+dfsg-1
1:27.3.4.8+dfsg-1
1:27.3.4.9+dfsg-1
1:27.3.4.10+dfsg-1
1:27.3.4.11+dfsg-1
1:27.3.4.11+dfsg-2
1:27.3.4.11+dfsg-3
1:27.3.4.11+dfsg-4
1:27.3.4.11+dfsg-5
1:27.3.4.11+dfsg-6
1:27.3.4.11+dfsg-7
1:27.3.4.12+dfsg-1
1:28.*
1:28.0+dfsg-1
1:28.0.1+dfsg-1
1:28.0.2+dfsg-1
1:28.0.4+dfsg-1
1:28.1.1+dfsg-1
1:28.2+dfsg-1
1:28.3+dfsg-1
1:28.3.1+dfsg-1
1:29.*
1:29.0~rc1+dfsg-1
1:29.0~rc1+dfsg-2
1:29.0~rc2+dfsg-1
1:29.0~rc3+dfsg-1
1:29.0~rc3+dfsg-2
1:29.0~rc3+dfsg-3
1:29.0~rc3+dfsg-4
1:29.0+dfsg-1
1:29.0+dfsg-2
1:29.0.1+dfsg-1
1:29.0.2+dfsg-1
1:29.0.3+dfsg-1
1:29.0.4+dfsg-1
1:29.0.6+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-28808.json"

Debian:13 / erlang

Package

Name
erlang
Purl
pkg:deb/debian/erlang?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1:27.3.4.1+dfsg-1+deb13u3

Affected versions

1:27.*
1:27.3.4.1+dfsg-1
1:27.3.4.1+dfsg-1+deb13u1
1:27.3.4.1+dfsg-1+deb13u2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-28808.json"

Debian:14 / erlang

Package

Name
erlang
Purl
pkg:deb/debian/erlang?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1:27.3.4.10+dfsg-1

Affected versions

1:27.*
1:27.3.4.1+dfsg-1
1:27.3.4.3+dfsg-1
1:27.3.4.4+dfsg-1
1:27.3.4.6+dfsg-1
1:27.3.4.8+dfsg-1
1:27.3.4.9+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-28808.json"