Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-vqax-fdy8-gkcv
Vulnerability ID VCID-vqax-fdy8-gkcv
Aliases CVE-2026-21620
Summary erlang: Erlang OTP tftp_file modules: Information disclosure via relative path traversal
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-23 Relative Path Traversal
System Score Found at
cvssv3 4.2 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-21620.json
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2026-21620
cvssv4 2.3 https://cna.erlef.org/cves/CVE-2026-21620.html
ssvc Track https://cna.erlef.org/cves/CVE-2026-21620.html
cvssv3.1 8.1 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv4 2.3 https://github.com/erlang/otp/commit/3970738f687325138eb75f798054fa8960ac354e
ssvc Track https://github.com/erlang/otp/commit/3970738f687325138eb75f798054fa8960ac354e
cvssv4 2.3 https://github.com/erlang/otp/commit/655fb95725ba2fb811740b57e106873833824344
ssvc Track https://github.com/erlang/otp/commit/655fb95725ba2fb811740b57e106873833824344
cvssv4 2.3 https://github.com/erlang/otp/commit/696fdec922661d4a3cc528fc34bc24fae8d4ad8a
ssvc Track https://github.com/erlang/otp/commit/696fdec922661d4a3cc528fc34bc24fae8d4ad8a
cvssv4 2.3 https://github.com/erlang/otp/pull/10706
ssvc Track https://github.com/erlang/otp/pull/10706
cvssv4 2.3 https://github.com/erlang/otp/security/advisories/GHSA-hmrc-prh3-rpvp
ssvc Track https://github.com/erlang/otp/security/advisories/GHSA-hmrc-prh3-rpvp
cvssv4 2.3 https://osv.dev/vulnerability/EEF-CVE-2026-21620
ssvc Track https://osv.dev/vulnerability/EEF-CVE-2026-21620
cvssv4 2.3 https://www.erlang.org/doc/system/versions.html#order-of-versions
ssvc Track https://www.erlang.org/doc/system/versions.html#order-of-versions
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-21620.json
https://api.first.org/data/v1/epss?cve=CVE-2026-21620
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21620
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
10706 https://github.com/erlang/otp/pull/10706
1128651 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1128651
2441326 https://bugzilla.redhat.com/show_bug.cgi?id=2441326
3970738f687325138eb75f798054fa8960ac354e https://github.com/erlang/otp/commit/3970738f687325138eb75f798054fa8960ac354e
655fb95725ba2fb811740b57e106873833824344 https://github.com/erlang/otp/commit/655fb95725ba2fb811740b57e106873833824344
696fdec922661d4a3cc528fc34bc24fae8d4ad8a https://github.com/erlang/otp/commit/696fdec922661d4a3cc528fc34bc24fae8d4ad8a
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
CVE-2026-21620.html https://cna.erlef.org/cves/CVE-2026-21620.html
EEF-CVE-2026-21620 https://osv.dev/vulnerability/EEF-CVE-2026-21620
GHSA-hmrc-prh3-rpvp https://github.com/erlang/otp/security/advisories/GHSA-hmrc-prh3-rpvp
versions.html#order-of-versions https://www.erlang.org/doc/system/versions.html#order-of-versions
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-21620.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://cna.erlef.org/cves/CVE-2026-21620.html
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-20T13:36:03Z/ Found at https://cna.erlef.org/cves/CVE-2026-21620.html
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/erlang/otp/commit/3970738f687325138eb75f798054fa8960ac354e
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-20T13:36:03Z/ Found at https://github.com/erlang/otp/commit/3970738f687325138eb75f798054fa8960ac354e
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/erlang/otp/commit/655fb95725ba2fb811740b57e106873833824344
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-20T13:36:03Z/ Found at https://github.com/erlang/otp/commit/655fb95725ba2fb811740b57e106873833824344
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/erlang/otp/commit/696fdec922661d4a3cc528fc34bc24fae8d4ad8a
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-20T13:36:03Z/ Found at https://github.com/erlang/otp/commit/696fdec922661d4a3cc528fc34bc24fae8d4ad8a
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/erlang/otp/pull/10706
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-20T13:36:03Z/ Found at https://github.com/erlang/otp/pull/10706
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/erlang/otp/security/advisories/GHSA-hmrc-prh3-rpvp
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-20T13:36:03Z/ Found at https://github.com/erlang/otp/security/advisories/GHSA-hmrc-prh3-rpvp
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://osv.dev/vulnerability/EEF-CVE-2026-21620
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-20T13:36:03Z/ Found at https://osv.dev/vulnerability/EEF-CVE-2026-21620
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://www.erlang.org/doc/system/versions.html#order-of-versions
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-20T13:36:03Z/ Found at https://www.erlang.org/doc/system/versions.html#order-of-versions
Exploit Prediction Scoring System (EPSS)
Percentile 0.1216
EPSS Score 0.00039
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T08:43:44.873478+00:00 RedHat Importer Import https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-21620.json 38.6.0