The vulnerability is an incorrect authorization flaw that permits unauthenticated users to run CGI scripts that are meant to be protected by directory rules when served via ScriptAlias. When a ScriptAlias maps a URL prefix to a directory outside the DocumentRoot, mod_auth applies directory-based access controls to a DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved location, creating a path mismatch. This mismatch allows attackers to invoke protected CGI scripts without authentication, potentially exposing sensitive functionality. The affected modules are lib/inets/src/http_server/mod_alias.erl, mod_auth.erl, and mod_cgi.erl, and the vulnerability covers OTP versions from 17.0 up to 28.4.2, including the 27.3.4.10 and 26.2.5.19 releases.

The Erlang/OTP runtime, specifically the inets HTTP server module, is affected. Versions from OTP 17.0 through OTP 28.4.2, as well as OTP 27.3.4.10 and OTP 26.2.5.19, are vulnerable. Any installation using ScriptAlias to expose CGI scripts is potentially at risk.

With a CVSS score of 8.3 the flaw is classified as high severity. The EPSS score is < 1% and it is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request to a URL under a ScriptAlias prefix, which the CGI module will execute regardless of directory rules. Exploitation requires only that a CGI script exists outside the DocumentRoot; the attacker can trigger its execution without authentication. The complexity of the attack is low and the impact is potential unauthorized execution of scripts, which could compromise the server if those scripts perform sensitive operations. Given these factors, the vulnerability poses a significant risk to affected systems.