CVE-2026-73270

CVE-2026-73270 is an improper handling of case sensitivity flaw (CWE-178) in the mod_auth component of the inets httpd web server shipped with Erlang/OTP. mod_auth:secret_path/3 checks whether a requested path falls inside a protected directory using re:run/3 without the caseless option, so a request whose path casing differs from the configured directory (for example /secret/file when /Secret is configured) is treated as unprotected, while a case-insensitive filesystem resolves it to the same files that httpd then serves without issuing an authentication challenge. A remote, unauthenticated attacker can therefore read any file inside a mod_auth-protected directory, potentially exposing credentials, configuration, or other sensitive data stored there. Only deployments on case-insensitive filesystems (such as Windows or macOS, or case-insensitive mounts) are affected; hosts on case-sensitive filesystems, which is the typical Linux/ext4 case, reject the mismatched casing and are not vulnerable. No exploitation is known at this time: there is no public proof of concept, the issue is not in CISA KEV, and EPSS estimates only a 0.7% probability of exploitation in the next 30 days.

What to do: Upgrade to OTP 27.3.4.17, OTP 28.5.0.6, or OTP 29.0.6 as appropriate for your branch (corresponding to inets 9.3.2.7, 9.6.2.3, or 9.7.2). As interim mitigations, ensure the casing configured in mod_auth matches the casing used in requests and by the filesystem, and restrict network access to httpd instances. Hosts on case-sensitive filesystems (typical Linux/ext4) are not vulnerable but should still be patched to maintain a supported, fixed version.