Weakness Type (CWE)

CWE-22 — CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CAPEC

CVSS 4.0 Score

4.8

MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L

Vulnerability description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation.

This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2 unless the memory option is passed.

This issue affects OTP from OTP 17.0 until OTP 28.0.1, OTP 27.3.4.1 and OTP 26.2.5.13, corresponding to stdlib from 2.0 until 7.0.1, 6.2.2.1 and 5.2.3.4.

Affected

pkg:otp/stdlib

Module Source File Routine
stdlib lib/stdlib/src/zip.erl zip:unzip/1
zip:unzip/2
zip:extract/1
zip:extract/2
Status Type Version Changes / Fixed in
affected otp ⓘ 17.0
  • unaffected at 28.0.1
  • unaffected at 27.3.4.1
  • unaffected at 26.2.5.13

pkg:github/erlang/otp

Module Source File Routine
stdlib lib/stdlib/src/zip.erl zip:unzip/1
zip:unzip/2
zip:extract/1
zip:extract/2
Status Type Version Changes / Fixed in
affected git ⓘ 07b8f441ca71

Workarounds

You can use zip:list_dir/1 on the archive and verify that no files contain absolute paths before extracting the archive to disk.

References

Credits

  • Finder: Wander Nauta
  • Remediation developer: Lukas Backström
  • Remediation reviewer: Björn Gustavsson

CVE record as JSON:  GET /cves/CVE-2025-4748.json
OSV record as JSON:  GET /osv/EEF-CVE-2025-4748.json