Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2 unless the memory option is passed.
This issue affects OTP from OTP 17.0 before OTP 28.0.1, OTP 27.3.4.1 and OTP 26.2.5.13, corresponding to stdlib from 2.0 before 7.0.1, 6.2.2.1 and 5.2.3.4.
CVSS Details
- CVSS 4.0 Base Score: 4.8 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 16, 2025 |
| Debian | — | Upgrade erlang | Jun 18, 2025 | Jun 16, 2025 |
| Freebsd | — | Upgrade erlang-runtime28Upgrade erlangUpgrade erlang-runtime27Upgrade erlang-runtime26 | Dec 10, 2025 | Oct 29, 2025 |
| Suse | — | Upgrade erlang26-wx-srcUpgrade erlang-jinterfaceUpgrade erlang26-debuggerUpgrade erlang26-diameterUpgrade erlang-diameterUpgrade erlang-observerUpgrade erlang26-reltool-srcUpgrade erlang26-srcUpgrade erlang26-etUpgrade erlang26Upgrade erlang-diameter-srcUpgrade erlang-dialyzerUpgrade erlang-dialyzer-srcUpgrade erlang-etUpgrade erlang26-observer-srcUpgrade erlang26-dialyzer-srcUpgrade erlang26-debugger-srcUpgrade erlang26-wxUpgrade erlang-et-srcUpgrade erlang26-observerUpgrade erlang26-jinterfaceUpgrade erlang26-et-srcUpgrade erlang26-dialyzerUpgrade erlang-reltoolUpgrade erlang26-jinterface-srcUpgrade erlang26-reltoolUpgrade erlang-wx-srcUpgrade erlang26-docUpgrade erlang-wxUpgrade erlang-srcUpgrade erlang-epmdUpgrade erlang-docUpgrade erlang-reltool-srcUpgrade erlang-observer-srcUpgrade erlang-jinterface-srcUpgrade erlang-debuggerUpgrade erlangUpgrade erlang26-diameter-srcUpgrade erlang-debugger-srcUpgrade erlang26-epmd | Jul 17, 2025 | Jun 16, 2025 |
| Ubuntu | — | Upgrade erlangUpgrade erlang-ssh | Jul 22, 2025 | Jun 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub