Description
Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive.

zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks directory depth as a running integer counter: .. decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as ../x/y causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via add_cwd.

This vulnerability is associated with program file lib/stdlib/src/zip.erl.

This issue affects OTP from OTP 27.1 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to stdlib from 6.1 before 8.0.3, 7.3.0.1 and 6.2.2.4.
Published: 2026-07-27
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability exists in the Erlang OTP standard library zip module. A crafted zip archive can be passed to zip:unzip/zip:extract, causing the path validation routine zip:check_dir_level/2 to accept entries whose intermediate path components temporarily drop the depth counter below zero but ultimately return to zero. This results in a final resolved file path that lies outside the intended extraction directory. The attacker can therefore create or overwrite files wherever the executing process has write permission. File overwrite can impact configuration files or binaries, leading to potential compromise of the system or denial of service. The weakness is a classic relative path traversal (CWE‑23).

Affected Systems

Erlang OTP versions prior to 29.0.4, including OTP 27.1 before 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, affect the stdlib zip module. These versions correspond to stdlib 6.1 before 8.0.3, 7.3.0.1 and 6.2.2.4 respectively, and are available on all platforms supported by Erlang OTP. Updates to OTP 29.0.4 or newer contain the fix.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate severity. The EPSS score is < 1%, indicating a very low but nonzero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, which suggests it has not yet seen widespread exploitation. Based on the description, it is inferred that the likely attack vector is the delivery of a crafted zip archive to an application that uses the vulnerable functions; attackers would need to supply such a malicious zip file. If the vulnerable OTP installation is running services that accept untrusted archives, the risk is higher. Given the moderate CVSS and very low EPSS, the priority is to apply the patch as soon as possible rather than immediately monitoring or mitigating denial of service.

Generated by OpenCVE AI on August 3, 2026 at 17:17 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Erlang OTP to version 29.0.4 or later, which contains the patched stdlib zip module
  • Update or rebuild any dependent applications to use the updated OTP distribution
  • Avoid extracting untrusted zip archives with otp’s zip:unzip or zip:extract; if disabling extraction is not viable, validate paths manually or use a third‑party library that is not vulnerable.

Generated by OpenCVE AI on August 3, 2026 at 17:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 31 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-22
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L'}

threat_severity

Moderate

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 27 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Erlang erlang/otp
Vendors & Products Erlang erlang/otp

Mon, 27 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks directory depth as a running integer counter: .. decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as ../x/y causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via add_cwd. This vulnerability is associated with program file lib/stdlib/src/zip.erl. This issue affects OTP from OTP 27.1 before 27.3.4.15, 28.5.0.4, and 29.0.4 corresponding to stdlib from 6.1 before 6.2.2.4, 7.3.0.1, and 8.0.3. Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks directory depth as a running integer counter: .. decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as ../x/y causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via add_cwd. This vulnerability is associated with program file lib/stdlib/src/zip.erl. This issue affects OTP from OTP 27.1 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to stdlib from 6.1 before 8.0.3, 7.3.0.1 and 6.2.2.4.

Mon, 27 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Description Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks directory depth as a running integer counter: .. decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as ../x/y causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via add_cwd. This vulnerability is associated with program file lib/stdlib/src/zip.erl. This issue affects OTP from OTP 27.1 before 27.3.4.15, 28.5.0.4, and 29.0.4 corresponding to stdlib from 6.1 before 6.2.2.4, 7.3.0.1, and 8.0.3.
Title Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass
First Time appeared Erlang
Erlang erlang\/otp
Weaknesses CWE-23
CPEs cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Vendors & Products Erlang
Erlang erlang\/otp
References
Metrics cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L'}

Subscriptions

Erlang Erlang/otp Erlang\/otp
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-07-28T09:53:55.522Z

Reserved: 2026-05-18T17:28:10.319Z

Link: CVE-2026-47078

cve-icon Vulnrichment

Updated: 2026-07-27T18:38:50.891Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-07-27T16:17:07.643

Modified: 2026-07-30T17:01:07.343

Link: CVE-2026-47078

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-27T15:03:50Z

Links: CVE-2026-47078 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T17:30:17Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-23

    Relative Path Traversal