CVE-2026-73270httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems
- 8.2HighCVSS base score
- 0.93%Exploitation in 30 daysEPSS · top 39% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. mod_auth:secret_path/3 decides whether a resolved filesystem path lies inside a protected directory block by running the configured directory path through re:run/3 without the caseless option. A request for /secret/file against a directory configured as /Secret therefore does not match, so the request is treated as unprotected and no authentication challenge is issued, while the filesystem resolves the differently cased path to the same file and mod_get serves it. Deployments on case-sensitive filesystems are unaffected, because there the filesystem itself rejects the mismatched casing. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Timeline
ID reserved
By EEF
- 15 days later
· 15 days later
Published
- 2 months later
· 2 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| EEFCNA (assigner) | 4.0 | High8.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| NVDNVD · Deferred | 4.0 | High8.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.93% · top 39% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.2.
Affected products
- affected 17.0 – < *
- affected 5.10 – < *
- affected 84adefa331c4159d432d22840663c38f155cd4c1 – < *
- unaffected bac19eb3dbd96cc49b6d8cabc1c04248bf8c79f6 – < *
- unaffected d8878dec0ececc2eab18e47bb18b472f224ca633 – < *
- unaffected 9641944a2efbf55bea760f8ff7ba777fe3a0961c – < *
What to do
Workaround: * Host the document root on a case-sensitive filesystem, where the mismatched casing does not resolve to the protected file. * Place a reverse proxy in front of httpd that performs its own case-insensitive path matching for the protected paths, or that normalises request path casing before forwarding. * Restrict access to the server to trusted clients where the deployment allows it.
References
References7
- https://github.com/erlang/otp/security/advisories/GHSA-mh78-93cr-jx8f (opens in a new tab)vendor-advisoryrelated
- EEF CNA record for CVE-2026-73270 (opens in a new tab)related
- OSV record EEF-CVE-2026-73270 (opens in a new tab)related
- Erlang/OTP version ordering (opens in a new tab)x_version-scheme
- Fix commit bac19eb in erlang/otp (opens in a new tab)patch
- Fix commit d8878de in erlang/otp (opens in a new tab)patch
- Fix commit 9641944 in erlang/otp (opens in a new tab)patch
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-69243 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-73270)Record last updated .