CVE-2026-21620: TFTP Path Traversal
- Is it exploited?
Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of . If CISA adds it, this page shows it as known exploited.
- How likely is exploitation in the next 30 days?
- 0.5%
EPSS score, percentile 44.4 of all scored records. A probability estimated by FIRST, not a report of exploitation.
- How severe?
- 2.3 Low
CVSS v4.0 base score, given by the CNA
- What should I do?
CISA has set no required action, because the vulnerability is not in KEV.
- Which versions are affected?
Affected
- 17.0
- from 5.10 to before 7.0
- 1.0
Unaffected from 26.2.5.17; from 27.3.4.8; from 28.3.2; from 1.1.1.1; from 1.2.2.1; from 1.2.4
Source: CISA KEV 2026.10.29, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.
What to do
Advisories and patches
This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | 17.0 |
| Unaffected | from 26.2.5.17 |
| Unaffected | from 27.3.4.8 |
| Unaffected | from 28.3.2 |
| Affected | 07b8f441ca71 |
| Unaffected | from 655fb95725ba |
| Unaffected | from 3970738f6873 |
| Unaffected | from 696fdec92266 |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | from 5.10 to before 7.0 |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | 1.0 |
| Unaffected | from 1.1.1.1 |
| Unaffected | from 1.2.2.1 |
| Unaffected | from 1.2.4 |
Versions not listed are: unaffected.
Versions the record lists as unaffected: 26.2.5.17, 27.3.4.8, 28.3.2, 655fb95725ba2fb811740b57e106873833824344, 3970738f687325138eb75f798054fa8960ac354e, 696fdec922661d4a3cc528fc34bc24fae8d4ad8a, 1.1.1.1, 1.2.2.1.
Source: CVE List, as of . About the data.
About this vulnerability
Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl. This issue affects OTP from OTP 17.0 before OTP 28.3.2, OTP 27.3.…
Summary: CVE record, as of .
- CISA has not added CVE-2026-21620 to its Known Exploited Vulnerabilities (KEV) catalog, as of 29 Oct 2026.
- The CVE record was published on 20 Feb 2026.
- The CVE record carries a CVSS v4.0 base score of 2.3 (Low), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 0.5% (percentile 44.4), as of 29 Oct 2026. EPSS is a statistical estimate, not a report of exploitation.
- CISA's SSVC assessment in the CVE record: exploitation none, automatable no, technical impact partial.
- The credits in the CVE record name AISLE as finder.
Source: CISA KEV 2026.10.29, as of ; CVE List, as of ; FIRST EPSS, as of . About the data.
Description
TFTP Path Traversal
Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl. This issue affects OTP from OTP 17.0 before OTP 28.3.2, OTP 27.3.4.8 and OTP 26.2.5.17, corresponding to tftp from 1.0 before 1.2.4, 1.2.2.1 and 1.1.1.1; also inets from 5.10 before 7.0.
Source: CVE List, as of . About the data.
Weakness
CWE-23, 1 CAPEC
- CWE-23: Relative Path Traversal
Attack patterns (CAPEC)
- CAPEC-139: Relative Path Traversal
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| CVE record last updated |
References
3
Known exploited Erlang vulnerabilities
- CVE-2025-32433: Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability