CVE-2026-73270

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 17.0 through 27.3.4.16 Erlang/OTP versions 28.0 through 28.5.0.5 Erlang/OTP versions 29.0 through 29.0.5

Description Improper handling of case sensitivity in the inets httpd component allows a remote unauthenticated attacker to read files within a mod auth protected directory on deployments using case-insensitive filesystems. The mod auth:secret path/3 function determines if a filesystem path is inside a protected block using re:run/3 without the caseless option. Consequently, if a request uses different casing than the configured directory (e.g., requesting /secret/file when the directory is configured as /Secret), the request is treated as unprotected and no authentication challenge is issued. The case-insensitive filesystem then resolves the path to the same file, which is served by mod get. This issue primarily affects environments like Windows and macOS where path resolution is case-insensitive by default.

Recommendations Update Erlang/OTP to version 27.3.4.17 or later. Update Erlang/OTP to version 28.5.0.6 or later. Update Erlang/OTP to version 29.0.6 or later. Host the document root on a case-sensitive filesystem. Implement a reverse proxy in front of httpd to perform case-insensitive path matching or normalize request path casing before forwarding. Restrict server access to trusted clients.