Absolute path traversal in zip:unzip/1,2 (Erlang OTP)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.29 % · percentile 22 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- EEF
- NVD status
- Deferred
Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2Â unless the memory option is passed. This issue affects OTP from OTP 17.0 before OTPÂ 28.0.1, OTPÂ 27.3.4.1 and OTPÂ 26.2.5.13, corresponding to stdlib from 2.0 before 7.0.1, 6.2.2.1 and 5.2.3.4.
Weaknesses (CWE)
- CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
References
- https://github.com/erlang/otp/security/advisories/GHSA-9g37-pgj9-wrhc
- https://cna.erlef.org/cves/CVE-2025-4748.html
- https://osv.dev/vulnerability/EEF-CVE-2025-4748
- https://www.erlang.org/doc/system/versions.html#order-of-versions
- https://github.com/erlang/otp/pull/9941
- https://github.com/erlang/otp/commit/5a55feec10c9b69189d56723d8f237afa58d5d4f
- https://github.com/erlang/otp/commit/ba2f2bc5f45fcfd2d6201ba07990a678bbf4cc8f
- https://github.com/erlang/otp/commit/578d4001575aa7647ea1efd4b2b7e3afadcc99a5
- http://www.openwall.com/lists/oss-security/2025/06/16/5
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 4.8 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L | EEF |
| CVSS 4.0 | MEDIUM 4.8 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · 6b3ad84c-e1a6-4bf7-a703-f496b71e49db (Secondary) |
European references
- ENISA EUVD · EUVD-2025-18414
- GCVE · GCVE-0-2025-4748
CERT-FR advisories
- CERTFR-2025-AVI-0621 — Multiples vulnérabilités dans les produits Tenable · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Erlang · OTP | affected 2.0 < * |
| Erlang · OTP | affected 17.0 < * ; affected 07b8f441ca711f9812fad9e9115bab3c3aa92f79 < * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |