Erlang/OTP inets httpd implements directory protection using mod_auth, which determines whether a path falls within a protected block by matching the configured directory against the request URI. The request URI is normalized using an algorithm that removes dot-segments but fails to collapse empty path segments. By placing an extra slash in the request path, the normalization preserves the doubled slash, allowing the regex match to fail and the request to be treated as unprotected. The operating system subsequently collapses the doubled slash, and the protected file is served, enabling an attacker to read sensitive files without authentication.

All Erlang/OTP releases from OTP 17.0 up to but not including OTP 27.3.4.17, from OTP 28.0 up to but not including OTP 28.5.0.6, and from OTP 29.0 up to but not including OTP 29.0.6 are affected. This corresponds to inets versions 5.10 up to 9.3.2.7, 9.4 up to 9.6.2.3, and 9.7 up to 9.7.2 respectively. The status of OTP versions before 17.0 (inets before 5.10) is unknown.

The vulnerability exhibits a CVSS score of 8.2, indicating high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. An attacker can exploit the flaw by sending a crafted HTTP request via a web browser or a tool such as curl, using an extra slash to bypass authentication and retrieve protected files. No special privileges are required on the target server beyond the ability to send HTTP requests to the inets httpd.