This vulnerability (CVE-2026-21620) is a relative path traversal issue classified under CWE-23, affecting Erlang OTP's tftp_file modules in OTP, inets, and tftp components. It arises from improper isolation or compartmentalization in the handling of file paths within the affected modules (lib/tftp/src/tftp_file.erl and src/tftp_file.erl). The affected OTP versions include 17.0 and versions prior to OTP 28.3.2, 27.3.4.8, and 26.2.5.17, with corresponding affected versions of tftp and inets. The CVSS 4.0 base score is 2.3, indicating low severity, with network attack vector, low complexity, partial privileges required, and low impact on confidentiality and integrity. No official patch or remediation details are provided in the input data.

The vulnerability allows an attacker with partial privileges to perform relative path traversal via the tftp_file modules, potentially leading to improper file access or isolation bypass. The impact on confidentiality and integrity is low, and no known exploits have been reported. The overall severity is low based on the CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor Erlang OTP vendor advisories for updates addressing this vulnerability. Until a fix is available, restrict access to the affected tftp_file modules and limit privileges of users interacting with these components to reduce risk.