Read the docs
TI-2025-04244 Aliases CVE-2025-4748

Absolute path traversal in zip:unzip/1,2

Priority LOW 28CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2 unless the memory option is passed. This issue affects OTP from OTP 17.0 before OTP 28.0.1, OTP 27.3.4.1 and OTP 26.2.5.13, corresponding to stdlib from 2.0 before 7.0.1, 6.2.2.1 and 5.2.3.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00292 21st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ErlangOTP2.0 and later—No fix listedCNA
ErlangOTP17.0 and later—No fix listedCNA
  • OTP VendorErlang Affected 2.0 and later Fixed in — No fix listed CNA
  • OTP VendorErlang Affected 17.0 and later Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*——Erlang
  • cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* Versions — — ·Erlang

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-4748

References

Patch 4

Advisory 1

Other 3

  • TI-2025-23504 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-48954 httpd parks a request worker indefinitely on a malformed chunk size sent after the headers CVSS 4.0HIGH 8.7
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2026-71037 Path traversal in rebar3 via unvalidated dependency app names CVSS 4.0HIGH 7.5
  • TI-2024-36042 ssl fails to validate incorrect extened key usage CVSS 3.1MEDIUM 5.5
  • TI-2020-10791 Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL… CVSS 3.1CRITICAL 9.8
See all 80 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences