CVE-2025-4748 · published 2025-06-16 · updated 2026-11-11

Absolute path traversal in zip:unzip/1,2

MEDIUM 4.8 CWE-22 · Improper Limitation of a Pathname to a Restricted Directory
OSV.dev JSON

Am I affected?

type your erlang.org/otp version to check

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation.

This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2 unless the memory option is passed.

This issue affects OTP from OTP 17.0 before OTP 26.2.5.13, OTP 27.3.4.1, and OTP 28.0.1, corresponding to stdlib from 2.0 before 5.2.3.4, 6.2.2.1, and 7.0.1.

Weaknesses & attack patterns

Weakness

CWE-22 · Improper Limitation of a Pathname to a Restricted Directory in catalog → MITRE ↗

Attack patterns

CAPEC-597 · Absolute Path Traversal MITRE ↗
CAPEC-165 · File Manipulation MITRE ↗

Affected — Erlang

≥ 17.0 and up affected
→ 26.2.5.13 not affected
→ 27.3.4.1 not affected
→ 28.0.1 not affected
every other version: unaffected
cpe cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:*
version type otp
modules · source files · routines
modules zip
source files lib/stdlib/src/zip.erl
routines zip:unzip/1 · zip:unzip/2 · zip:extract/1 · zip:extract/2

Affected — Erlang / stdlib Repository ↗

≥ 2.0 and up affected
→ 5.2.3.4 not affected
→ 6.2.2.1 not affected
→ 7.0.1 not affected
every other version: unaffected
cpe cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:*
version type otp
modules · source files · routines
modules zip
source files src/zip.erl
routines zip:unzip/1 · zip:unzip/2 · zip:extract/1 · zip:extract/2

Affected — GitHub / erlang/otp Repository ↗

≥ 07b8f44 and up affected
→ 578d400 not affected
→ ba2f2bc not affected
→ 5a55fee not affected
every other version: unaffected
cpe cpe:2.3:a:erlang:erlang/otp:*:*:*:*:*:*:*:*
version type git
modules · source files · routines
modules zip
source files lib/stdlib/src/zip.erl
routines zip:unzip/1 · zip:unzip/2 · zip:extract/1 · zip:extract/2

Workarounds

You can use zip:list_dir/1 on the archive and verify that no files contain absolute paths before extracting the archive to disk.

References

Absolute Path in Zip Module (github.com) vendor-advisory
https://github.com/erlang/otp/pull/9941 patch
Fix commit 578d400 in erlang/otp (github.com) patch
Fix commit ba2f2bc in erlang/otp (github.com) patch
Fix commit 5a55fee in erlang/otp (github.com) patch
OSV record EEF-CVE-2025-4748 (osv.dev) related
Introducing commit 07b8f44 in erlang/otp (github.com) related

Credits

Wander Nauta Finder
Lukas Backström Remediation developer
Björn Gustavsson Remediation reviewer

CVSS breakdown

MEDIUM 4.8 open in calculator →
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
« All CVEs