EEF-CVE-2026-28808

Summary

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.

When scriptalias maps a URL prefix to a directory outside DocumentRoot, modauth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.

This vulnerability is associated with program files lib/inets/src/httpserver/modalias.erl, lib/inets/src/httpserver/modauth.erl, and lib/inets/src/httpserver/modcgi.erl.

This issue affects OTP from OTP 17.0 until OTP 28.4.2, 27.3.4.10 and 26.2.5.19 corresponding to inets from 5.10 until 9.6.2, 9.3.2.4 and 9.1.0.6.

Workaround

• Move CGI scripts inside DocumentRoot and use alias instead of scriptalias to ensure modauth resolves the correct path.
• Apply URL-based access controls at a reverse proxy layer to block unauthenticated access to the script_alias URL prefix.
• Remove mod_cgi from the httpd modules chain if CGI functionality is not required.

Configuration

The inets httpd server must use scriptalias to map a URL prefix to a CGI directory, combined with directory-based access controls (e.g., modauth) protecting the scriptalias target path. The vulnerability applies whenever the scriptalias target path differs from DocumentRoot + URL prefix.