PT-2026-64979 · Unknown · Erlang/Otp
CVSS v4.0
4.8
Medium
| Vector | AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L |
Name of the Vulnerable Software and Affected Versions
Erlang OTP versions 27.1 through 27.3.4.14
Erlang OTP versions 28.0 through 28.5.0.3
Erlang OTP versions 29.0 through 29.0.3
Description
A relative path traversal issue in the stdlib zip module allows writing files outside the intended extraction directory when processing a crafted zip archive. The functions
zip:unzip/1,2 and zip:extract/1,2 use zip:check dir level/2 to validate entry paths by tracking directory depth with an integer counter. Because the validation only rejects paths where the final counter value is negative, a path like ../x/y can cause the counter to go negative during traversal and then return to zero, bypassing the check and resolving to a location outside the extraction directory via add cwd. This issue is located in the lib/stdlib/src/zip.erl file.Recommendations
Update Erlang OTP to version 27.3.4.15 or later.
Update Erlang OTP to version 28.5.0.4 or later.
Update Erlang OTP to version 29.0.4 or later.
Fix
Relative Path Traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Erlang/Otp