The vulnerability in Erlang OTP's inets HTTP server modules (mod_alias, mod_auth, and mod_cgi) allows unauthorized users to access CGI scripts that should be protected by directory-based access controls. This occurs because mod_auth checks access permissions against a path relative to DocumentRoot, while mod_cgi executes the script using the path resolved by ScriptAlias, which may point outside DocumentRoot. This path mismatch leads to bypassing authentication and authorization controls. Affected versions include OTP from 17.0 up to but not including 28.4.2, 27.3.4.10, and 26.2.5.19, with corresponding inets module versions from 5.10 up to but not including 9.6.2, 9.3.2.4, and 9.1.0.6. No official remediation level or patch is indicated in the provided data. The Red Hat advisory URL is provided but does not explicitly state patch status in the input.

Successful exploitation allows unauthenticated attackers to bypass directory-based access controls and gain unauthorized access to CGI scripts that were intended to be protected. This can lead to unauthorized execution of scripts, potentially exposing sensitive information or enabling further attacks. The vulnerability affects the integrity of access control mechanisms in the Erlang OTP inets HTTP server.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-28808 for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Users should monitor the vendor advisory for updates and apply patches once available.