Erlang/OTP inets CVE-2026-73270

Three conditions must hold simultaneously. First, the target must run Erlang/OTP inets httpd with mod_auth configured to protect one or more directories - deployments using other Erlang web frameworks such as Cowboy or Phoenix/Plug are entirely unaffected. Second, the server must be hosted on a case-insensitive filesystem: Windows NTFS and macOS default HFS+/APFS qualify; Linux ext4, xfs, and btrfs (case-sensitive by default) do not, and such deployments are fully immune regardless of OTP version. Third, the attacker must request a specific file using a path whose directory component casing differs from the configured protected directory name - directory enumeration or prior knowledge of filenames is therefore a practical prerequisite. No privileges or user interaction are required on affected deployments. Exploitation is bounded to confidentiality; no write path, privilege escalation, or code execution vector exists through this flaw.

The CVSS 4.0 score of 8.2 reflects network-accessible, unauthenticated read of high-confidentiality data, but the AT:P (Attack Requirements: Present) metric is the decisive differentiator - exploitation is strictly limited to deployments on case-insensitive filesystems such as Windows NTFS and macOS default HFS+/APFS. The large majority of production Erlang deployments run on Linux with case-sensitive ext4 or similar filesystems, rendering them immune because the OS itself rejects mismatched casing before mod_get can serve anything. EPSS data was not provided in the available intelligence, and the vulnerability is absent from CISA KEV with no proof-of-concept identified in the provided data - consistent with no widespread exploit tooling having emerged yet. Where conditions are met, the attack requires zero privileges and zero user interaction, and the high confidentiality impact means protected credentials, configuration secrets, or application data are directly readable over the network. Real-world risk is high for the specific Windows and macOS deployment population using inets httpd with mod_auth, and low to negligible for the broader Erlang ecosystem on standard Linux infrastructure.

An unauthenticated attacker targeting a Windows Server host running Erlang/OTP inets httpd sends GET /Secret/admin.cfg HTTP/1.1 when the mod_auth-protected directory is configured as /secret/. The regex in secret_path/3 does not match /Secret/ against /secret/ without the caseless option, so no WWW-Authenticate challenge is issued; NTFS resolves both paths to the same file and mod_get returns the file contents directly. No public exploit code has been identified at time of analysis, and the technique requires only a standard HTTP client with knowledge of a valid filename within a protected directory.