CVE-2026-28808
ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)
- Published
- Updated
- Reserved
- Assigned by
- EEF
Description
Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect. This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl. This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| EEFCNA (assigner) | 4.0 | High8.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N |
| redhat-SADPADP (enrichment) | 3.1 | High7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| NVDNVD · Modified | 4.0 | High8.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.57% · top 53% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.3.
Weakness
Affected products
What to do
Workaround: * Move CGI scripts inside DocumentRoot and use alias instead of script_alias to ensure mod_auth resolves the correct path. * Apply URL-based access controls at a reverse proxy layer to block unauthenticated access to the script_alias URL prefix. * Remove mod_cgi from the httpd modules chain if CGI functionality is not required.
References (10)
- GitHub Advisory (opens in a new tab)relatedvendor-advisory
- EEF CNA record for CVE-2026-28808 (opens in a new tab)related
- OSV record EEF-CVE-2026-28808 (opens in a new tab)related
- Erlang/OTP version ordering (opens in a new tab)x_version-scheme
- Introducing commit 07b8f44 in erlang/otp (opens in a new tab)related
- Fix commit 8fc71ac in erlang/otp (opens in a new tab)patch
- Fix commit 9dfa0c5 in erlang/otp (opens in a new tab)patch
- https://access.redhat.com/security/cve/CVE-2026-28808 (opens in a new tab)vdb-entryx_refsource_REDHAT
- RHBZ#2455909 (opens in a new tab)issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28808.json (opens in a new tab)x_sadp-csaf-vex
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-28808)Record last updated .