This vulnerability (CVE-2026-21620) in Erlang OTP's tftp_file modules allows relative path traversal, classified under CWE-23. It affects OTP versions from 17.0 and earlier versions starting from 5.10 before 7.0. The issue arises from improper isolation or compartmentalization in handling file paths, potentially enabling unauthorized file access. The CVSS 4.0 score is 2.3, reflecting a low-impact vulnerability with network attack vector, low privileges required, and partial impact on confidentiality and integrity. No vendor advisory or patch information is provided, and no exploits are known.

The vulnerability could allow an attacker with low privileges to perform relative path traversal via the tftp_file modules, potentially accessing files outside intended directories. However, the impact is limited as indicated by the low CVSS score (2.3), with only partial confidentiality and integrity impact and no availability impact. There are no known exploits in the wild, suggesting limited or no active exploitation currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is provided, users should monitor Erlang OTP security updates for any forthcoming fixes. Until then, restrict access to vulnerable modules and limit privileges where possible to reduce risk.