UpHeron
All vulnerabilities

Servers and applications

CVE-2026-28808

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved…

Severity
High 8.3
Published
7 Apr 2026
Last changed
8 Sept 2026
Added to UpHeron
16 Oct 2026
Fixed in
26.2.5.19, 27.3.4.10, 28.4.2
Sources
NVD

Affected software

SoftwareAffected versions
Erlang/OTPServers and applications · cpe:a:erlang:erlang\/otp
  • From 17.0 before 26.2.5.19
  • From 27.0 before 27.3.4.10
  • From 28.0 before 28.4.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-28808
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-28808