CVE-2026-66835: CWE-50 Path Equivalence: '//multiple/leading/slash' in Erlang OTP

The vulnerability arises because httpd_request:validate_uri/1 normalizes URIs by removing dot-segments but does not collapse empty path segments, allowing doubled slashes to remain. When mod_alias:real_name/3 concatenates the document root with the URI containing doubled slashes, mod_auth:secret_path/3 uses an unanchored regex to check if the path lies inside a protected directory. The doubled slash breaks the regex match, causing the request to be treated as unprotected and bypassing authentication. The operating system collapses the doubled slashes when accessing the file, allowing mod_get to serve protected files without authentication. This also evades per-path accounting in mod_security. The issue affects OTP versions from 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, and 29.0 before 29.0.6, corresponding to inets versions from 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, and 9.7 before 9.7.2. It is unknown if versions before OTP 17.0 are affected.

An unauthenticated remote attacker can bypass HTTP authentication protections on directories protected by mod_auth in the Erlang/OTP inets httpd server. This allows unauthorized reading of files within these protected directories, potentially exposing sensitive information. The vulnerability also bypasses per-path accounting in mod_security, which could hinder detection and logging of unauthorized access attempts.

Fixed versions are available for the affected OTP and inets releases. Users should upgrade to OTP versions 27.3.4.17 or later, 28.5.0.6 or later, and 29.0.6 or later, or the corresponding inets versions 9.3.2.7 or later, 9.6.2.3 or later, and 9.7.2 or later. Patch status is confirmed by the version ranges provided. No vendor advisory content contradicts this; therefore, upgrading to these fixed versions is the recommended remediation.