{"affected":[{"defaultStatus":"unaffected","ecosystem":"software-id","packageName":"otp","product":"OTP","source":"CNA: EEF","vendor":"Erlang","versions":[{"changes":[{"at":"26.2.5.17","status":"unaffected"},{"at":"27.3.4.8","status":"unaffected"},{"at":"28.3.2","status":"unaffected"}],"lessThan":"*","status":"affected","version":"17.0","versionType":"otp"}]},{"defaultStatus":"unaffected","ecosystem":"otp","packageName":"inets","product":"OTP","source":"CNA: EEF","vendor":"Erlang","versions":[{"lessThan":"7.0","status":"affected","version":"5.10","versionType":"otp"}]},{"defaultStatus":"unaffected","ecosystem":"otp","packageName":"tftp","product":"OTP","source":"CNA: EEF","vendor":"Erlang","versions":[{"changes":[{"at":"1.1.1.1","status":"unaffected"},{"at":"1.2.2.1","status":"unaffected"},{"at":"1.2.4","status":"unaffected"}],"lessThan":"*","status":"affected","version":"1.0","versionType":"otp"}]},{"defaultStatus":"unaffected","ecosystem":"github","packageName":"erlang/otp","product":"OTP","source":"CNA: EEF","vendor":"Erlang","versions":[{"changes":[{"at":"655fb95725ba2fb811740b57e106873833824344","status":"unaffected"},{"at":"3970738f687325138eb75f798054fa8960ac354e","status":"unaffected"},{"at":"696fdec922661d4a3cc528fc34bc24fae8d4ad8a","status":"unaffected"}],"lessThan":"*","status":"affected","version":"07b8f441ca711f9812fad9e9115bab3c3aa92f79","versionType":"git"}]}],"cveId":"CVE-2026-21620","cwes":["CWE-23"],"description":"Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal.\n\nThis vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.17, OTP 27.3.4.8, and OTP 28.3.2, corresponding to inets from 5.10 before 7.0, and tftp from 1.0 before 1.1.1.1, 1.2.2.1, and 1.2.4.","epss":{"date":"2026-11-10","percentile":0.4448,"score":0.00519},"exploits":[],"kev":null,"metrics":[{"score":2.3,"severity":"low","source":"CNA: EEF","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794426522293,"publishedAt":1771585028620,"references":[{"source":"CNA: EEF","tags":["vendor-advisory","related"],"url":"https://github.com/erlang/otp/security/advisories/GHSA-hmrc-prh3-rpvp"},{"source":"CNA: EEF","tags":["related"],"url":"https://cna.erlef.org/cves/CVE-2026-21620.html"},{"source":"CNA: EEF","tags":["related"],"url":"https://osv.dev/vulnerability/EEF-CVE-2026-21620"},{"source":"CNA: EEF","tags":["x_version-scheme"],"url":"https://www.erlang.org/doc/system/versions.html#order-of-versions"},{"source":"CNA: EEF","tags":["patch"],"url":"https://github.com/erlang/otp/pull/10706"},{"source":"CNA: EEF","tags":["related"],"url":"https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79"},{"source":"CNA: EEF","tags":["patch"],"url":"https://github.com/erlang/otp/commit/655fb95725ba2fb811740b57e106873833824344"},{"source":"CNA: EEF","tags":["patch"],"url":"https://github.com/erlang/otp/commit/3970738f687325138eb75f798054fa8960ac354e"},{"source":"CNA: EEF","tags":["patch"],"url":"https://github.com/erlang/otp/commit/696fdec922661d4a3cc528fc34bc24fae8d4ad8a"}],"remediation":[{"kind":"fix","source":"CNA: EEF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/erlang/otp/pull/10706"},{"kind":"fix","source":"CNA: EEF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/erlang/otp/commit/655fb95725ba2fb811740b57e106873833824344"},{"kind":"fix","source":"CNA: EEF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/erlang/otp/commit/3970738f687325138eb75f798054fa8960ac354e"},{"kind":"fix","source":"CNA: EEF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/erlang/otp/commit/696fdec922661d4a3cc528fc34bc24fae8d4ad8a"}],"revision":"366608e96644b6162e46a1d04ea680ac3a6c4968da6e2fd53d919e550d65c665","sources":[{"modifiedAt":1794426522293,"name":"CNA: EEF","retrievedAt":1794427746877,"url":"https://www.cve.org/CVERecord?id=CVE-2026-21620"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794427767079,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-21620"}],"ssvc":{"assessedAt":1771594563423,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"TFTP Path Traversal","updatedAt":1794427767079}