The vulnerability stems from a mismatch between how the authentication module evaluates directory-based rules and how the CGI module resolves script paths when a ScriptAlias is defined. When a URL prefix is mapped outside the DocumentRoot, the authentication module checks access controls against the DocumentRoot‑relative path while the CGI module executes the script at the actual ScriptAlias‑resolved location. This confusion allows unauthenticated users to invoke CGI scripts that were intended to be protected, resulting in unauthorized execution of those scripts.

The Erlang/OTP runtime, specifically the inets HTTP server module, is affected. Versions from OTP 17.0 through OTP 28.4.2, including the 27.3.4.10 and 26.2.5.19 snapshots, cover inets components 5.10 through 9.6.2, 9.3.2.4, and 9.1.0.6. Any installation that uses ScriptAlias to expose CGI scripts is potentially vulnerable.

With a CVSS score of 8.3 the flaw is classified as high severity. The EPSS score is not available and it is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request to a URL under a ScriptAlias prefix, which the CGI module will execute regardless of directory rules. Exploitation requires only that a CGI script exists outside the DocumentRoot; the attacker can trigger its execution without authentication. The complexity of the attack is low and the impact is potential unauthorized execution of scripts, which could compromise the server if those scripts perform sensitive operations. Given these factors, the vulnerability poses a significant risk to affected systems.