Relative Path Traversal in otp - CVE-2026-21620

Vulnerability identifier: #VU125772

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-21620

CWE-ID: CWE-23

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to read and write arbitrary files.

The vulnerability exists due to relative path traversal in the Erlang/OTP TFTP server when handling remote file requests with ../ path components while using the undocumented root_dir option. A remote user can send crafted file requests to read and write arbitrary files.

Exploitation requires that the system designer used the undocumented {root_dir,RootDir} option under incorrect assumptions and that the service is reachable from untrusted hosts.

otp
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
Server Applications Module
openSUSE Leap
openEuler
Fedora
PowerVC
erlang-sasl
erlang-mnesia
erlang-observer
erlang-odbc
erlang-os_mon
erlang-parsetools
erlang-public_key
erlang-reltool
erlang-runtime_tools
erlang-megaco
erlang-snmp
erlang-ssh
erlang-ssl
erlang-stdlib
erlang-syntax_tools
erlang-tftp
erlang-tools
erlang-dialyzer
erlang
erlang-asn1
erlang-common_test
erlang-compiler
erlang-crypto
erlang-debugger
erlang-debuginfo
erlang-debugsource
erlang-kernel
erlang-diameter
erlang-edoc
erlang-eldap
erlang-erl_docgen
erlang-erl_interface
erlang-erts
erlang-et
erlang-xmerl
erlang-eunit
erlang-examples
erlang-ftp
erlang-hipe
erlang-inets
erlang-jinterface
erlang-wx
erlang-epmd-debuginfo
erlang-observer-src
erlang-src
erlang-diameter-src
erlang-reltool-src
erlang-jinterface-src
erlang-dialyzer-debuginfo
erlang-wx-debuginfo
erlang-doc
erlang-dialyzer-src
erlang-debugger-src
erlang-wx-src
erlang-et-src
erlang-epmd
erlang26-et
erlang26-debuginfo
erlang26-debugger
erlang26-dialyzer
erlang26-src
erlang26-jinterface-src
erlang26-dialyzer-debuginfo
erlang26-reltool-src
erlang26-debugger-src
erlang26-observer-src
erlang26-diameter
erlang26-et-src
erlang26-diameter-src
erlang26-reltool
erlang26-dialyzer-src
erlang26-wx-debuginfo
erlang26-debugsource
erlang26-doc
erlang26-epmd-debuginfo
erlang26-epmd
erlang26-jinterface
erlang26
erlang26-wx
erlang26-wx-src
erlang26-observer

Install security update from vendor's website.

otp - addressed in versions 26.2.5.17, 27.3.4.8, 28.3.2
erlang-sasl - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-mnesia - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-observer - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-odbc - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-os_mon - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-parsetools - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-public_key - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-reltool - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-runtime_tools - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-megaco - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-snmp - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-ssh - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-ssl - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-stdlib - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-syntax_tools - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-tftp - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-tools - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-dialyzer - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-asn1 - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-common_test - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-compiler - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-crypto - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-debugger - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-debuginfo - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-debugsource - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-kernel - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-diameter - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-edoc - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-eldap - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-erl_docgen - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-erl_interface - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-erts - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-et - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-xmerl - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-eunit - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-examples - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-ftp - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-hipe - update to 23.3.4.9-10
erlang-inets - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-jinterface - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-wx - addressed in versions 23.3.4.9-10, 25.3.2.6-15, 25.3.2.6-17
erlang-epmd-debuginfo - update to 23.3.4.19-150300.3.32.1
erlang-diameter - update to 23.3.4.19-150300.3.32.1
erlang-observer-src - update to 23.3.4.19-150300.3.32.1
erlang-src - update to 23.3.4.19-150300.3.32.1
erlang-et - update to 23.3.4.19-150300.3.32.1
erlang-diameter-src - update to 23.3.4.19-150300.3.32.1
erlang-reltool-src - update to 23.3.4.19-150300.3.32.1
erlang-jinterface-src - update to 23.3.4.19-150300.3.32.1
erlang-dialyzer-debuginfo - update to 23.3.4.19-150300.3.32.1
erlang-jinterface - update to 23.3.4.19-150300.3.32.1
erlang-reltool - update to 23.3.4.19-150300.3.32.1
erlang-debugger - update to 23.3.4.19-150300.3.32.1
erlang-wx-debuginfo - update to 23.3.4.19-150300.3.32.1
erlang-doc - update to 23.3.4.19-150300.3.32.1
erlang-debuginfo - update to 23.3.4.19-150300.3.32.1
erlang-dialyzer-src - update to 23.3.4.19-150300.3.32.1
erlang-debugger-src - update to 23.3.4.19-150300.3.32.1
erlang-dialyzer - update to 23.3.4.19-150300.3.32.1
erlang-debugsource - update to 23.3.4.19-150300.3.32.1
erlang - update to 23.3.4.19-150300.3.32.1
erlang-wx-src - update to 23.3.4.19-150300.3.32.1
erlang-wx - update to 23.3.4.19-150300.3.32.1
erlang-et-src - update to 23.3.4.19-150300.3.32.1
erlang-epmd - update to 23.3.4.19-150300.3.32.1
erlang-observer - update to 23.3.4.19-150300.3.32.1
erlang-src - addressed in versions 25.3.2.6-15, 25.3.2.6-17
erlang26-et - update to 26.2.1-150300.7.25.1
erlang26-debuginfo - update to 26.2.1-150300.7.25.1
erlang26-debugger - update to 26.2.1-150300.7.25.1
erlang26-dialyzer - update to 26.2.1-150300.7.25.1
erlang26-src - update to 26.2.1-150300.7.25.1
erlang26-jinterface-src - update to 26.2.1-150300.7.25.1
erlang26-dialyzer-debuginfo - update to 26.2.1-150300.7.25.1
erlang26-reltool-src - update to 26.2.1-150300.7.25.1
erlang26-debugger-src - update to 26.2.1-150300.7.25.1
erlang26-observer-src - update to 26.2.1-150300.7.25.1
erlang26-diameter - update to 26.2.1-150300.7.25.1
erlang26-et-src - update to 26.2.1-150300.7.25.1
erlang26-diameter-src - update to 26.2.1-150300.7.25.1
erlang26-reltool - update to 26.2.1-150300.7.25.1
erlang26-dialyzer-src - update to 26.2.1-150300.7.25.1
erlang26-wx-debuginfo - update to 26.2.1-150300.7.25.1
erlang26-debugsource - update to 26.2.1-150300.7.25.1
erlang26-doc - update to 26.2.1-150300.7.25.1
erlang26-epmd-debuginfo - update to 26.2.1-150300.7.25.1
erlang26-epmd - update to 26.2.1-150300.7.25.1
erlang26-jinterface - update to 26.2.1-150300.7.25.1
erlang26 - update to 26.2.1-150300.7.25.1
erlang26-wx - update to 26.2.1-150300.7.25.1
erlang26-wx-src - update to 26.2.1-150300.7.25.1
erlang26-observer - update to 26.2.1-150300.7.25.1
erlang - addressed in versions 26.2.5.17-1.fc42, 26.2.5.17-1.fc43

• https://github.com/erlang/otp/security/advisories/GHSA-hmrc-prh3-rpvp
• https://github.com/advisories/GHSA-hmrc-prh3-rpvp

• Relative Path Traversal in otp
• Fedora 42 update for erlang
• Fedora 43 update for erlang
• SUSE update for erlang
• IBM PowerVC update for erlang otp
• SUSE update for erlang26
• openEuler 24.03 LTS SP1 update for erlang
• openEuler 22.03 LTS SP4 update for erlang
• openEuler 24.03 LTS SP3 update for erlang