CVE-2025-4748
Fixed in a distro release EPSS <1%CVSS 4.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2 unless the memory option is passed. This issue affects OTP from OTP 17.0 before OTP 28.0.1, OTP 27.3.4.1 and OTP 26.2.5.13, corresponding to stdlib from 2.0 before 7.0.1, 6.2.2.1 and 5.2.3.4.
Products: erlang otp
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | erlang | 28.0.1-1 |
| Debian 11 | erlang | 1:23.2.6+dfsg-1+deb11u3 |
| Debian 12 | erlang | 1:25.2.3+dfsg-1+deb12u2 |
| Debian 13 | erlang | 1:27.3.4.1+dfsg-1 |
| Debian 14 | erlang | 1:27.3.4.1+dfsg-1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP6 | erlang | 23.3.4.19-150300.3.23.3 |
| SUSE Linux Enterprise Module for Server Applications 15 SP6 | erlang26 | 26.2.1-150300.7.14.3 |
| SUSE Linux Enterprise Module for Server Applications 15 SP7 | erlang | 23.3.4.19-150300.3.23.3 |
| SUSE Linux Enterprise Module for Server Applications 15 SP7 | erlang26 | 26.2.1-150300.7.14.3 |
| SUSE Linux Enterprise Server 16.0 | erlang | 27.1.3-160000.5.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | erlang | 27.1.3-160000.5.1 |
| Ubuntu 22.04 LTS | erlang | 1:24.2.1+dfsg-1ubuntu0.5 |
| Ubuntu 22.04 LTS | erlang | 1:24.2.1+dfsg-1ubuntu0.8 |
| Ubuntu 24.04 LTS | erlang | 1:25.3.2.8+dfsg-1ubuntu4.8 |
| Ubuntu 24.04 LTS | erlang | 1:25.3.2.8+dfsg-1ubuntu4.4 |
| Ubuntu 25.10 | erlang | 1:27.3.4.1+dfsg-1 |
| Ubuntu 26.04 LTS | erlang | 1:27.3.4.6+dfsg-1ubuntu0.2 |
| Ubuntu Pro 14.04 LTS | erlang | 1:16.b.3-dfsg-1ubuntu2.2+esm3 |
| Ubuntu Pro 14.04 LTS | erlang | no fix |
| Ubuntu Pro 16.04 LTS | erlang | 1:18.3-dfsg-1ubuntu3.1+esm4 |
| Ubuntu Pro 18.04 LTS | erlang | 1:20.2.2+dfsg-1ubuntu2+esm4 |
| Ubuntu Pro 20.04 LTS | erlang | 1:22.2.7+dfsg-1ubuntu0.5+esm3 |
| openSUSE Leap 15.6 | erlang | 23.3.4.19-150300.3.23.3 |
| openSUSE Leap 15.6 | erlang26 | 26.2.1-150300.7.14.3 |
| openSUSE Leap 16.0 | erlang | 27.1.3-160000.5.1 |
| openSUSE Tumbleweed | erlang27 | 27.1.3-2.1 |