CVE-2026-73270: CWE-178 Improper Handling of Case Sensitivity in Erlang OTP

The vulnerability arises because mod_auth:secret_path/3 uses a regex match without the caseless option to verify if a requested path lies within a protected directory. On case-insensitive filesystems, a differently cased request path does not match the configured protected directory path, causing the authentication check to be bypassed. The filesystem resolves the differently cased path to the same file, which mod_get then serves without authentication. This issue affects Erlang/OTP versions from 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, and 29.0 before 29.0.6, corresponding to inets versions from 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, and 9.7 before 9.7.2. Whether versions before OTP 17.0 are affected is unknown.

An unauthenticated remote attacker can bypass HTTP authentication protections on mod_auth protected directories by exploiting case-insensitive filesystem behavior, allowing unauthorized reading of files that should be protected. This can lead to sensitive information disclosure without requiring any privileges or user interaction.

A fix is available in OTP versions 27.3.4.17, 28.5.0.6, and 29.0.6 and corresponding inets versions 9.3.2.7, 9.6.2.3, and 9.7.2. Users should upgrade to these or later versions to remediate the vulnerability. Patch status is confirmed by the version ranges provided. No vendor advisory content contradicts this remediation.