Skip to content
fr Sign in
4.8 Medium

CVE-2026-47078 Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended…

Description

Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks directory depth as a running integer counter: .. decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as ../x/y causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via add_cwd. This vulnerability is associated with program file lib/stdlib/src/zip.erl. This issue affects OTP from OTP 27.1 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to stdlib from 6.1 before 6.2.2.4, 7.3.0.1, and 8.0.3.

Affected products and versions

Product Affected versions Fixed in
otp Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of otp

The 64 CVEs of otp →
CVE-2026-96596 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm… 5.9 Medium CVE-2026-105236 Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a… 6.3 Medium CVE-2026-94200 Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and… 8.2 High CVE-2026-65634 Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated… 8.2 High
Track this CVE