PT-2025-25546 · Ericsson+5 · Stdlib+6
Björn Gustavsson
+2
·
Published
2025-01-01
·
Updated
2025-11-24
·
CVE-2025-4748
CVSS v4.0
4.8
Medium
| Vector | AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L |
Name of the Vulnerable Software and Affected Versions
Erlang OTP versions 17.0 through 28.0.1
Erlang OTP version 27.3.4.1
Erlang OTP version 26.2.5.13
stdlib versions 2.0 through 7.0.1
stdlib version 6.2.2.1
stdlib version 5.2.3.4
Description
The issue is related to a Path Traversal vulnerability in Erlang OTP, specifically in the stdlib modules. This vulnerability allows Absolute Path Traversal and File Manipulation. It is associated with the program files lib/stdlib/src/zip.erl and the routines
zip:unzip/1, zip:unzip/2, zip:extract/1, and zip:extract/2, unless the memory option is used.Recommendations
For Erlang OTP versions 17.0 through 28.0.1, consider disabling the
zip:unzip/1 and zip:unzip/2 functions until a patch is available.
For Erlang OTP version 27.3.4.1, restrict access to the zip:extract/1 and zip:extract/2 routines to minimize the risk of exploitation.
For Erlang OTP version 26.2.5.13, avoid using the zip module until the issue is resolved.
For stdlib versions 2.0 through 7.0.1, consider applying configuration changes to limit the impact of the vulnerability.
For stdlib version 6.2.2.1, restrict access to the vulnerable zip.erl file to prevent exploitation.
For stdlib version 5.2.3.4, consider disabling the zip module as a temporary workaround until a patch is available.Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Erlang/Otp
Linuxmint
Red Os
Suse
Ubuntu
Stdlib