CVE-2026-28808

Critical · CVSS 9.8

Erlang OTP inets — Incorrect Authorization / Authentication Bypass via path mismatch in CGI script_alias

CVSS: 9.8; nvd
EPSS: 0.54%; 42th pct
KEV: No
Class: oss containerizable; CWE-863, CWE-551

Description

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect. This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl. This issue affects OTP from OTP 17.0 before OTP 28.4.2, OTP 27.3.4.10 and OTP 26.2.5.19, corresponding to inets from 5.10 before 9.6.2, 9.3.2.4 and 9.1.0.6.

Search profile — drives PoC discovery

Symbols mod_alias.erlmod_auth.erlmod_cgi.erlscript_aliasScriptAliasDocumentRootlib/inets/src/http_server/mod_alias.erllib/inets/src/http_server/mod_auth.erllib/inets/src/http_server/mod_cgi.erl

Keywords CVE-2026-28808Erlang OTP inets authentication bypassscript_alias CGI auth bypassmod_auth mod_cgi path mismatchinets httpd CGI bypassGHSA-3vhp-h532-mc3fErlang inets incorrect authorizationmod_alias mod_auth directory rules bypassOTP inets CGI unauthenticated accessEEF-CVE-2026-28808

Versions: OTP 17.0 to OTP 28.4.2 / 27.3.4.10 / 26.2.5.19 (inets 5.10 to 9.6.2 / 9.3.2.4 / 9.1.0.6)

References

Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-07-01T06:30:14.000Z