CVE-2026-21620: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-21620 is a Relative Path Traversal vulnerability (CWE-23/CWE-22) in the tftp_file module of Erlang/OTP's TFTP implementation. It affects the erlang/otp (from version 17.0 and commit 07b8f441), erlang otp inets (versions 5.10 before 7.0), and erlang otp tftp (from version 1.0) packages, specifically in lib/tftp/src/tftp_file.erl and src/tftp_file.erl. The vulnerability was published on February 20, 2026, with a patch merged the same day. It carries a CVSS v4.0 base score of 2.3 (Low), though the CVSS category estimate is rated HIGH by some sources (Red Hat CVE, Feedly).

The root cause lies in the handle_initial function within tftp_file.erl, which previously used a filename_join helper that failed to properly validate that a requested filename remained within a configured root_dir. The old implementation used filename:join/2 to combine the root_dir with the requested filename but did not use filelib:safe_relative_path/2, allowing relative path components (e.g., ../../etc/passwd) to escape the intended directory boundary — a classic CWE-23 (Relative Path Traversal) flaw. The attack requires network access to a running TFTP service and low-level privileges (authenticated), with elevated attack complexity due to specific preconditions. The fix replaces the unsafe filename_join with a new safe_filename function that validates the root_dir is absolute and a real directory, then calls filelib:safe_relative_path/2 to reject any path that resolves outside the root (GitHub PR #10706, OTP commit maint-26).

Successful exploitation allows an authenticated attacker with low privileges to read or write files outside the intended TFTP root directory, limited to files accessible by the Erlang VM's OS user. This results in low confidentiality impact (unauthorized file reads, e.g., sensitive configuration files) and low integrity impact (unauthorized file writes), with no direct availability impact. The scope is limited to the system running the TFTP server, but file write capability could enable further compromise depending on what files are writable by the Erlang VM process (Feedly, IBM Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.055% (0.000550), indicating a very low probability of exploitation in the near term. Exploitation requires network access to a TFTP service, low privileges, and specific attack conditions, further limiting practical risk.

1. Reconnaissance: Identify hosts running Erlang OTP TFTP services (default UDP port 69) using network scanners such as Nmap (nmap -sU -p 69 <target>) or Shodan. Confirm the service is running a vulnerable version of Erlang OTP.
2. Assess root_dir configuration: Determine whether the TFTP server is started without the {root_dir, Dir} option in the tftp_file callback, which is the vulnerable default configuration.
3. Craft path traversal request: Send a TFTP read (RRQ) or write (WRQ) request with a filename containing relative path traversal sequences, such as ../../etc/passwd or ../../../sensitive_file, targeting files accessible by the Erlang VM's OS user.
4. Retrieve or overwrite file: If the server is vulnerable, the TFTP response will return the contents of the traversed file (read) or overwrite it (write), bypassing the intended directory restriction.

Note: No public PoC tools are known; these steps are based on the vulnerability's technical description and patch analysis (GitHub PR #10706, OTP commit maint-28).

• Network: Unusual TFTP (UDP/69) traffic containing filenames with ../ or ..\ sequences; TFTP requests for files outside expected directories (e.g., /etc/passwd, /etc/shadow, system configuration files).
• Logs: TFTP server logs showing file access requests with path traversal patterns (e.g., ../../, %2e%2e/); access to files not normally served by the TFTP service.
• File System: Unexpected modification timestamps on sensitive system files (e.g., /etc/passwd, /etc/cron*) that could indicate unauthorized writes via TFTP; new or modified files in directories accessible by the Erlang VM user.
• Process: Erlang VM process (beam.smp) performing file I/O on paths outside the expected TFTP serving directory.

Patches have been merged into Erlang/OTP maintenance branches for OTP 26, 27, and 28 (targeting OTP 28.4 milestone), replacing the unsafe filename_join with filelib:safe_relative_path/2-based validation (GitHub PR #10706). Downstream distributions including Fedora, openSUSE/SUSE, Debian, and IBM PowerVC have released updated packages (IBM Advisory, Feedly). As an immediate workaround, explicitly configure the tftp_file callback with the {root_dir, Dir} option when starting the TFTP server (e.g., {callback, {"", tftp_file, [{root_dir, "/srv/tftp"}]}}), and disable TFTP services entirely if not required. Restrict OS-level file permissions for the Erlang VM user to minimize the impact of any traversal.

The Erlang/OTP maintainer RaimoNiskanen authored and merged the patch on February 20, 2026, and explicitly updated the documentation to warn that the default TFTP configuration (without root_dir) is a security vulnerability, recommending all users configure the root_dir option (GitHub PR #10706). Multiple Linux distributions (Fedora, openSUSE, SUSE, Debian) issued security advisories and updated packages in the weeks following disclosure. IBM published a security bulletin for affected PowerVC products (IBM Advisory). Community discussion on the Elixir Forum noted the release of OTP 28.3.2 as a patch package addressing this issue.