The vulnerability is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Erlang OTP’s stdlib ZIP module, allowing absolute path traversal and file manipulation. Because the pathname checks are insufficient, attacker‑supplied ZIP archives that contain absolute paths can cause extraction functions zip:unzip/1, zip:unzip/2, zip:extract/1, or zip:extract/2 to write files outside the intended directory when the memory option is not used. The weakness is classified as CWE‑22 and can result in accidental or intentional modification of system files.

Erlang OTP is affected in releases from 17.0 up to but not including 28.0.1, with specific vulnerable build identifiers including OTP 27.3.4.1 and OTP 26.2.5.13. Corresponding stdlib versions 2.0 before 7.0.1, 6.2.2.1 and 5.2.3.4 are impacted. The flaw manifests in the standard library modules handling ZIP archives such as zip:unzip/1, zip:unzip/2, zip:extract/1 and zip:extract/2 when the memory option is not used.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score of less than 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, so no large‑scale exploits are currently documented. Attackers would need access to the system or the ability to supply a crafted ZIP archive to the vulnerable functions. Based on the description it is inferred that the attack vector is local or involves an application that accepts untrusted archives. The workaround of examining archive entries with zip:list_dir/1 before extraction mitigates the risk until a patch is applied.