Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation.
This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2 unless the memory option is passed.
This issue affects OTP from OTP 17.0 before OTP 26.2.5.13, OTP 27.3.4.1, and OTP 28.0.1, corresponding to stdlib from 2.0 before 5.2.3.4, 6.2.2.1, and 7.0.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Erlang | OTP | 17.0, 2.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | erlang | 1:27.3.4.1+dfsg-1 | — |
| Debian 13 | erlang | 1:27.3.4.1+dfsg-1 | — |
| Debian 12 | erlang | 1:25.2.3+dfsg-1+deb12u2 | — |
| Debian 11 | erlang | 1:23.2.6+dfsg-1+deb11u3 | DLA-4376-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | erlang | 1:27.3.4.6+dfsg-1ubuntu0.2 | USN-8901-1 |
| Ubuntu 25.10 | erlang | 1:27.3.4.1+dfsg-1 | — |
| Ubuntu 24.04 LTS | erlang | 1:25.3.2.8+dfsg-1ubuntu4.4 | USN-8901-1, USN-7656-1 |
| Ubuntu 22.04 LTS | erlang | 1:24.2.1+dfsg-1ubuntu0.5 | USN-8901-1, USN-7656-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | erlang | 1:22.2.7+dfsg-1ubuntu0.5+esm3 | USN-8901-1 |
| Ubuntu Pro 18.04 LTS | erlang | 1:20.2.2+dfsg-1ubuntu2+esm4 | USN-8901-1 |
| Ubuntu Pro 16.04 LTS | erlang | 1:18.3-dfsg-1ubuntu3.1+esm4 | USN-8901-1 |
| Ubuntu Pro 14.04 LTS | erlang | 1:16.b.3-dfsg-1ubuntu2.2+esm3 | USN-8901-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | erlang | 23.3.4.19-150300.3.23.3 | SUSE-SU-2025:02332-1 |
| SLES 15 SP7 | erlang26 | 26.2.1-150300.7.14.3 | SUSE-SU-2025:02331-1 |
| SLES 15 SP6 | erlang | 23.3.4.19-150300.3.23.3 | SUSE-SU-2025:02332-1 |
| SLES 15 SP6 | erlang26 | 26.2.1-150300.7.14.3 | SUSE-SU-2025:02331-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | erlang | 27.1.3-160000.5.1 | SUSE-SU-2026:22082-1 |
| SLES 16.0 | erlang | 27.1.3-160000.5.1 | SUSE-SU-2026:22082-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | erlang27 | 27.1.3-2.1 | openSUSE-SU-2026:10947-1 |
| openSUSE Leap 16.0 | erlang | 27.1.3-160000.5.1 | openSUSE-SU-2026:20907-1 |
| openSUSE Leap 15.6 | erlang | 23.3.4.19-150300.3.23.3 | SUSE-SU-2025:02332-1 |
| openSUSE Leap 15.6 | erlang26 | 26.2.1-150300.7.14.3 | SUSE-SU-2025:02331-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | erlang | 26.2.5.13-1 | — |
| Azure Linux 2 (CBL-Mariner) | erlang | 25.3.2.21-2 | — |
Advisories 9
- USN-8901-1 erlang vulnerabilities Ubuntu Security Notices (USN) · Oct 8, 2026
- SUSE-SU-2026:22082-1 Security update for erlang SUSE / openSUSE Security Updates · Jun 16, 2026
- WID-SEC-2025-1333 Erlang/OTP: Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Jun 14, 2026
- openSUSE-SU-2026:20907-1 Security update for erlang SUSE / openSUSE Security Updates · Jun 9, 2026
- openSUSE-SU-2026:10947-1 erlang27-27.1.3-2.1 on GA media SUSE / openSUSE Security Updates · Jun 4, 2026
- USN-7656-1 erlang vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- SUSE-SU-2025:02331-1 Security update for erlang26 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02332-1 Security update for erlang SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-4376-1 erlang - security update Debian Security (DSA / DLA) · Nov 24, 2025
References
- Absolute Path in Zip Module vendor-advisory related
- EEF CNA record for CVE-2025-4748 related
- OSV record EEF-CVE-2025-4748 related
- Erlang/OTP version ordering
- https://github.com/erlang/otp/pull/9941 patch
- Introducing commit 07b8f44 in erlang/otp related
- Fix commit 578d400 in erlang/otp patch
- Fix commit ba2f2bc in erlang/otp patch
- Fix commit 5a55fee in erlang/otp patch