Low 2.3Published Feb 20, 2026

CVE-2026-21620TFTP Path Traversal

Updated under an hour ago (Oct 27, 2026, 11:40 AM ET)

Does this affect you?

It affects Erlang OTP and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Erlang OTP

Exploited in the last 30 days

Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl. This issue affects OTP from OTP 17.0 before OTP 28.3.2, OTP 27.3.4.8 and OTP 26.2.5.17, corresponding to tftp from 1.0 before 1.2.4, 1.2.2.1 and 1.1.1.1; also inets from 5.10 before 7.0.

CVSS: 2.3 LOW (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-23
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: EEF
NVD analysis: Deferred
Record last updated: Jul 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Erlang OTP erlang:erlang/otp	from 17.0; fixed at 26.2.5.17, fixed at 27.3.4.8, fixed at 28.3.2; from 07b8f441ca711f9812fad9e9115bab3c3aa92f79; fixed at 655fb95725ba2fb811740b57e106873833824344, fixed at 3970738f687325138eb75f798054fa8960ac354e, fixed at 696fdec922661d4a3cc528fc34bc24fae8d4ad8a	CNA record
Erlang OTP erlang:otp (from the name)	from 5.10 before 7.0	CNA record

References

References

https://github.com/erlang/otp/security/advisories/GHSA-hmrc-prh3-rpvp	vendor-advisory, related
https://cna.erlef.org/cves/CVE-2026-21620.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-21620	related
https://www.erlang.org/doc/system/versions.html#order-of-versions	x-version-scheme
https://github.com/erlang/otp/pull/10706	patch
https://github.com/erlang/otp/commit/696fdec922661d4a3cc528fc34bc24fae8d4ad8a	patch
https://github.com/erlang/otp/commit/3970738f687325138eb75f798054fa8960ac354e	patch
https://github.com/erlang/otp/commit/655fb95725ba2fb811740b57e106873833824344	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.