---
id: CVE-2026-28808
title: >-
  Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows
  unauthenticated access to CGI scripts protected by directory rules when served
  via script_alias.


  When script_alias maps a URL prefix to a directory outside Docum…
summary: >-
  Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows
  unauthenticated access to CGI scripts protected by directory rules when served
  via script_alias.


  When script_alias maps a URL prefix to a directory outside Docum…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-863
  - CWE-551
vendor: erlang
product: erlang/inets
affected:
  - 'erlang/inets >= 5.10, < 9.1.0.6'
  - 'erlang/inets > 9.2, < 9.3.2.4'
  - 'erlang/inets > 9.4, < 9.6.2'
  - 'erlang/otp >= 17.0, < 26.2.5.19'
  - 'erlang/otp >= 27.0, < 27.3.4.10'
  - 'erlang/otp >= 28.0, < 28.4.2'
patched:
  - erlang/inets 9.6.2
  - erlang/otp 28.4.2
published: '2026-04-07'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T14:17:21.527'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-28808'
references:
  - url: 'https://cna.erlef.org/cves/CVE-2026-28808.html'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/erlang/otp/commit/8fc71ac6af4fbcc54103bec2983ef22e82942688
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/erlang/otp/commit/9dfa0c51eac97866078e808dec2183cb7871ff7c
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: 'https://github.com/erlang/otp/security/advisories/GHSA-3vhp-h532-mc3f'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-28808'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: 'https://www.erlang.org/doc/system/versions.html#order-of-versions'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: 'https://access.redhat.com/security/cve/CVE-2026-28808'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2455909'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28808.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-04-07T13:14:10.515632Z'
epss: 0.00556
epssPercentile: 0.45218
ingestedAt: '2026-09-08T14:34:05.971Z'
scores:
  nvd: 9.8
  cna: 8.3
---

## Overview

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.

When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.

This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.

This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

## Affected

- `erlang/inets >= 5.10, < 9.1.0.6`
- `erlang/inets > 9.2, < 9.3.2.4`
- `erlang/inets > 9.4, < 9.6.2`
- `erlang/otp >= 17.0, < 26.2.5.19`
- `erlang/otp >= 27.0, < 27.3.4.10`
- `erlang/otp >= 28.0, < 28.4.2`

## Remediation

Upgrade past the affected range:

- `erlang/inets 9.6.2`
- `erlang/otp 28.4.2`