4.8
Medium
CVE-2025-4748 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib…
Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2 unless the memory option is passed. This issue affects OTP from OTP 17.0 before OTP 28.0.1, OTP 27.3.4.1 and OTP 26.2.5.13, corresponding to stdlib from 2.0 before 7.0.1, 6.2.2.1 and 5.2.3.4.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| otp 17.0 | 17.0 → latest | No fix stated |
References
- github.com github.com
- cna.erlef.org cna.erlef.org
- osv.dev osv.dev
- www.erlang.org www.erlang.org
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of otp
The 64 CVEs of otp →
CVE-2026-96596
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm…
5.9
Medium
CVE-2026-105236
Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a…
6.3
Medium
CVE-2026-94200
Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and…
8.2
High
CVE-2026-65634
Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated…
8.2
High