Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl. This issue affects otp: from 17.0, from 07b8f441ca711f9812fad9e9115bab3c3aa92f79; otp: from 5.10 before 7.0; otp: from 1.0.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1714-1 advisory.

    - CVE-2026-21620: remote arbitrary read/write via TFTP relative path traversal (bsc#1258663).
    - CVE-2026-23941: HTTP Request Smuggling in Erlang OTP (bsc#1259687).
    - CVE-2026-23942: path traversal vulnerability in Erlang OTP (bsc#1259681).
    - CVE-2026-23943: denial of service due to improper handling of highly compressed data in Erlang OTP ssh     (bsc#1259682).
    - CVE-2026-28808: incorrect authorization can lead to unauthenticated access to protected CGI scripts     (bsc#1261728).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the erlang package has been released.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20607-1 advisory.

    Security issues fixed:

    - CVE-2026-21620: improper isolation and compartmentalization can lead to TFTP relative path traversal and     remote       arbitrary reads/writes (bsc#1258663).
    - CVE-2026-23941: improper handling of duplicate Content-Length headers in Erlang OTP can lead to HTTP     request       smuggling (bsc#1259687).
    - CVE-2026-23942: improper limitation of a pathname to a restricted directory in the SFTP server can lead     to path       traversal (bsc#1259681).
    - CVE-2026-23943: improper handling of highly compressed data in Erlang OTP ssh can lead to denial of     service       (bsc#1259682).
    - CVE-2026-28808: incorrect authorization can lead to unauthenticated access to protected CGI scripts     (bsc#1261728).
    - CVE-2026-28810: predictable DNS transaction IDs can lead to DNS cache poisoning (bsc#1261726).
    - CVE-2026-32144: missing signature verification can lead to OCSP authorization bypass and information     disclosure       (bsc#1261734).

    Other updates and bugfixes:

    - jinterface: allow to build determenistic OtpErlang.jar (bsc#1262288).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8a15e7a423 advisory.

    Erlang ver. 26.2.5.17


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d51972eee3 advisory.

    Erlang ver. 26.2.5.17


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp     (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows     Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl,     src/tftp_file.erl. This issue affects otp: from 17.0, from 07b8f441ca711f9812fad9e9115bab3c3aa92f79; otp:
    from 5.10 before 7.0; otp: from 1.0. (CVE-2026-21620)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
313669	SUSE SLES15 Security Update : erlang (SUSE-SU-2026:1714-1)	Nessus	SuSE Local Security Checks	high
312353	Photon OS 5.0: Erlang PHSA-2026-5.0-0831	Nessus	PhotonOS Local Security Checks	high
312351	Photon OS 4.0: Erlang PHSA-2026-4.0-1005	Nessus	PhotonOS Local Security Checks	high
310082	openSUSE 16 Security Update : erlang (openSUSE-SU-2026:20607-1)	Nessus	SuSE Local Security Checks	high
300866	Fedora 43 : erlang (2026-8a15e7a423)	Nessus	Fedora Local Security Checks	low
300390	Fedora 42 : erlang (2026-d51972eee3)	Nessus	Fedora Local Security Checks	low
299721	Linux Distros Unpatched Vulnerability : CVE-2026-21620	Nessus	Misc.	low

Detections

Analytics

CVE-2026-21620

low

Tenable Plugins

high

high

high

high

low

low

low