This vulnerability arises from improper limitation of pathname checks in Erlang OTP’s zip processing library, allowing an attacker to specify files with absolute paths in a ZIP archive. When such an archive is extracted the application writes files to locations outside the intended extraction directory, potentially overwriting crucial configuration or executable files. The weakness is classified as CWE‑22 and can lead to information disclosure or malicious code execution by creating or modifying files on the file system.

Erlang OTP is affected in releases from 17.0 through 28.0.1, with specific vulnerable build identifiers including OTP 27.3.4.1 and OTP 26.2.5.13. Corresponding stdlib versions 2.0 through 7.0.1, 6.2.2.1 and 5.2.3.4 are impacted. The flaw manifests in the standard library modules handling ZIP archives such as zip:unzip/1, zip:unzip/2, zip:extract/1 and zip:extract/2 when the memory option is not used.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score of less than 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, so no large‑scale exploits are currently documented. Attackers would need access to the system or the ability to supply a crafted ZIP archive to the vulnerable functions. Based on the description it is inferred that the attack vector is local or a remote service that accepts untrusted archives. The proposed workaround of examining archive entries with zip:list_dir/1 before extraction mitigates the risk until a patch is applied.