This vulnerability arises because mod_auth evaluates directory access controls against the DocumentRoot-relative path, while mod_cgi executes scripts based on the ScriptAlias-resolved path. When script_alias maps a URL prefix to a directory outside DocumentRoot, this path mismatch allows bypassing directory-based authorization rules, enabling unauthenticated users to access CGI scripts that should be protected. The issue affects Erlang OTP versions 17.0 through 28.4.2 and corresponding inets module versions. The affected files include mod_alias.erl, mod_auth.erl, and mod_cgi.erl within the inets HTTP server implementation.

An attacker can gain unauthorized access to CGI scripts that are intended to be protected by directory-based access controls. This could lead to unauthorized execution of scripts, potentially exposing sensitive information or enabling further attacks. The vulnerability does not require user interaction or privileges and has a high severity rating (CVSS 8.3). No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently documented, users should monitor Erlang's official channels for updates. Until a fix is available, consider restricting access to CGI scripts served via script_alias through external means such as network-level controls or web server frontends that enforce proper authorization.