A crafted zip archive can cause the Erlang OTP standard library zip module to write files outside the intended extraction directory by exploiting a flaw in the path validation routine zip:check_dir_level/2. The routine counts directory depth, decrementing for ".." components and incrementing for normal components, and only rejects paths whose final counter is negative. Paths that temporarily go negative and then recover, such as "../x/y", pass validation. When the path is joined with the current working directory, the resulting location lies outside the intended base directory, giving an attacker the ability to create or overwrite files wherever the OTP process has write permission. This is a classic relative path traversal weakness (CWE‑22 / CWE‑23) that can compromise configuration files, binaries, or other critical data. Affected systems: The vulnerability exists in Erlang OTP releases from 27.1 up to but excluding 27.3.4.15, as well as in the standalone OTP releases 28.5.0.4 and 29.0.4. These OTP releases correspond to stdlib major versions 6.1 (up to before 6.2.2.4), 7.3.0.1 (for OTP 28.5.0.4), and 8.0.3 (for OTP 29.0.4). Any installation using these OTP or stdlib versions is susceptible. Updated OTP releases that include the patched stdlib zip module (OTP 27.3.4.15 or later, OTP 28.5.0.5 or later, OTP 29.0.5 or later) are not affected. Risk and exploitability: The CVSS v3.1 score of 4.8 indicates moderate severity, while the EPSS score of less than 1% denotes a very low but nonzero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. The likely attack vector is the delivery of a malicious zip archive to an application that invokes OTP’s zip:unzip or zip:extract functions. If an OTP-based service processes untrusted archives, the risk is higher; otherwise, a cautious approach is warranted, with patching recommended as the priority.

Erlang OTP versions 27.1 through 27.3.4.14, 28.5.0.4, and 29.0.4 are affected; the corresponding stdlib releases are 6.1 (up to before 6.2.2.4), 7.3.0.1, and 8.0.3 respectively. Upgrading to OTP 27.3.4.15 or newer, OTP 28.5.0.5 or newer, or OTP 29.0.5 or newer eliminates the flaw.

The CVSS score of 4.8 signals moderate risk. EPSS below 1% indicates a very low yet nonzero exploitation probability, and the vulnerability is not currently listed in KEV. Attackers would need to supply a crafted zip archive to the vulnerable functions for exploitation. Systems that accept untrusted archives are at higher risk, warranting immediate patching.