A relative path traversal flaw in the tftp_file module of Erlang OTP enables an attacker to request files outside the intended directory by including directory traversal characters in a TFTP file request. The weakness is classified as CWE-22 and CWE-23, and if successfully exploited the attacker can read sensitive files on the host system, compromising confidentiality.

All Erlang OTP releases from 1.0, from 5.10 before 7.0, and from 17.0 onward are impacted, including the specific commit ranges referenced in the advisory. The vulnerability resides in the tftp_file module used by the OTP inets and tftp applications.

The CVSS score of 2.3 indicates low severity, and the EPSS score of less than 1% shows a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. It appears to be exploitable via the TFTP service; an attacker who can send a crafted TFTP request containing traversal sequences may read arbitrary files on the server.