Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2 unless the memory option is passed.
This issue affects OTP from OTP 17.0 before OTP 28.0.1, OTP 27.3.4.1 and OTP 26.2.5.13, corresponding to stdlib from 2.0 before 7.0.1, 6.2.2.1 and 5.2.3.4.
CVSS Details
- CVSS 4.0 Base Score: 4.8 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 16, 2025 |
| Debian | — | Upgrade erlang | Jun 18, 2025 | Jun 16, 2025 |
| Freebsd | — | Upgrade erlang-runtime26Upgrade erlangUpgrade erlang-runtime27Upgrade erlang-runtime28 | Dec 10, 2025 | Oct 29, 2025 |
| Suse | — | Upgrade erlang-diameterUpgrade erlang-observerUpgrade erlang26Upgrade erlang-dialyzerUpgrade erlang26-observerUpgrade erlang26-dialyzer-srcUpgrade erlang-dialyzer-srcUpgrade erlang-etUpgrade erlang26-et-srcUpgrade erlang26-jinterfaceUpgrade erlang26-wx-srcUpgrade erlang26-reltool-srcUpgrade erlang26-srcUpgrade erlang-diameter-srcUpgrade erlang-jinterfaceUpgrade erlang26-etUpgrade erlang26-wxUpgrade erlang26-diameterUpgrade erlang26-observer-srcUpgrade erlang26-debuggerUpgrade erlang26-dialyzerUpgrade erlang26-debugger-srcUpgrade erlang-et-srcUpgrade erlang-reltool-srcUpgrade erlang-reltoolUpgrade erlang26-reltoolUpgrade erlang-docUpgrade erlang-observer-srcUpgrade erlang26-diameter-srcUpgrade erlang-debugger-srcUpgrade erlang26-epmdUpgrade erlang-jinterface-srcUpgrade erlang26-jinterface-srcUpgrade erlang-epmdUpgrade erlang26-docUpgrade erlang-wx-srcUpgrade erlangUpgrade erlang-debuggerUpgrade erlang-wxUpgrade erlang-src | Jul 17, 2025 | Jun 16, 2025 |
| Ubuntu | — | Upgrade erlangUpgrade erlang-ssh | Jul 22, 2025 | Jun 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub