CVE-2026-28808: ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)
- Is it exploited?
Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of . If CISA adds it, this page shows it as known exploited.
- How likely is exploitation in the next 30 days?
- 0.6%
Down from 0.8% on .
EPSS score, percentile 46.3 of all scored records. A probability estimated by FIRST, not a report of exploitation.
- How severe?
- 8.3 High
CVSS v4.0 base score, given by the CNA
- What should I do?
CISA has set no required action, because the vulnerability is not in KEV.
- Which versions are affected?
Affected
- 17.0
- 5.10
Unaffected from 26.2.5.19; from 27.3.4.10; from 28.4.2; from 9.1.0.6; from 9.3.2.4; from 9.6.2
Source: CISA KEV 2026.10.29, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.
What to do
Workaround (from the CVE record)
* Move CGI scripts inside DocumentRoot and use alias instead of script_alias to ensure mod_auth resolves the correct path. * Apply URL-based access controls at a reverse proxy layer to block unauthenticated access to the script_alias URL prefix. * Remove mod_cgi from the httpd modules chain if CGI functionality is not required.
Advisories and patches
This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | 17.0 |
| Unaffected | from 26.2.5.19 |
| Unaffected | from 27.3.4.10 |
| Unaffected | from 28.4.2 |
Versions not listed are: unknown.
| Status | Versions |
|---|---|
| Affected | 5.10 |
| Unaffected | from 9.1.0.6 |
| Unaffected | from 9.3.2.4 |
| Unaffected | from 9.6.2 |
Versions not listed are: unknown.
| Status | Versions |
|---|---|
| Affected | 07b8f441ca71 |
| Unaffected | from 8fc71ac6af4f |
| Unaffected | from 9dfa0c51eac9 |
Versions not listed are: unknown.
Versions the record lists as unaffected: 26.2.5.19, 27.3.4.10, 28.4.2, 9.1.0.6, 9.3.2.4, 9.6.2, 8fc71ac6af4fbcc54103bec2983ef22e82942688, 9dfa0c51eac97866078e808dec2183cb7871ff7c.
Source: CVE List, as of . About the data.
About this vulnerability
Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved p…
Summary: CVE record, as of .
- CISA has not added CVE-2026-28808 to its Known Exploited Vulnerabilities (KEV) catalog, as of 29 Oct 2026.
- The CVE record was published on 7 Apr 2026.
- The CVE record carries a CVSS v4.0 base score of 8.3 (High), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 0.6% (percentile 46.3), as of 29 Oct 2026. EPSS is a statistical estimate, not a report of exploitation.
- CISA's SSVC assessment in the CVE record: exploitation none, automatable yes, technical impact partial.
- The credits in the CVE record name AISLE as finder.
Source: CISA KEV 2026.10.29, as of ; CVE List, as of ; FIRST EPSS, as of . About the data.
Description
ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)
Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect. This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl. This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Source: CVE List, as of . About the data.
Weakness
CWE-863, 1 CAPEC
- CWE-863: Incorrect Authorization
Attack patterns (CAPEC)
- CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| CVE record last updated |
References
4
Known exploited Erlang vulnerabilities
- CVE-2025-32433: Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability