This vulnerability in Erlang OTP's inets HTTP server modules involves incorrect authorization due to inconsistent path evaluation between mod_auth and mod_cgi when script_alias is used to map URLs outside the DocumentRoot. Specifically, mod_auth checks access controls against the DocumentRoot-relative path, while mod_cgi executes scripts based on the ScriptAlias-resolved path. This discrepancy enables unauthenticated access to CGI scripts that should be protected by directory-based access controls. The issue affects OTP versions 17.0 through 28.4.2 and corresponding inets versions. The affected source files include mod_alias.erl, mod_auth.erl, and mod_cgi.erl.

The vulnerability allows unauthenticated attackers to bypass directory-based access controls and execute CGI scripts that were intended to be protected. This could lead to unauthorized execution of server-side scripts, potentially exposing sensitive information or enabling further attacks. The CVSS 4.0 score of 8.3 reflects a high severity impact with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor Erlang OTP vendor advisories for updates. Until a fix is available, consider avoiding configurations that use script_alias to map URLs outside DocumentRoot or implement additional access controls at other layers to restrict unauthorized access to CGI scripts.