{"id":"AZL-78285","summary":"CVE-2026-21620 affecting package erlang for versions less than 26.2.5.17-1","details":"Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.3.2, OTP 27.3.4.8 and OTP 26.2.5.17, corresponding to tftp from 1.0 before 1.2.4, 1.2.2.1 and 1.1.1.1; also inets from 5.10 before 7.0.","modified":"2026-08-28T17:48:02.370425724Z","published":"2026-02-20T11:15:56Z","upstream":["CVE-2026-21620"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21620"}],"affected":[{"package":{"name":"erlang","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/erlang"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.5.17-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-78285.json"}}],"schema_version":"1.9.0"}