CVE-2025-4748

Absolute path traversal in zip:unzip/1,2

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2 unless the memory option is passed. This issue affects OTP from OTP 17.0 until OTP 28.0.1, OTP 27.3.4.1 and OTP 26.2.5.13, corresponding to stdlib from 2.0 until 7.0.1, 6.2.2.1 and 5.2.3.4.

Remediation

Workaround:

  • You can use zip:list_dir/1 on the archive and verify that no files contain absolute paths before extracting the archive to disk.

Category

4.8
CVSS
Severity: Medium
CVSS 4.0 •
EPSS 0.01%
Vendor Advisory github.com
Affected: Erlang OTP
Published at:
Updated at:

References

Frequently Asked Questions

What is the severity of CVE-2025-4748?
CVE-2025-4748 has been scored as a medium severity vulnerability.
How to fix CVE-2025-4748?
As a workaround for remediating CVE-2025-4748: You can use zip:list_dir/1 on the archive and verify that no files contain absolute paths before extracting the archive to disk.
Is CVE-2025-4748 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2025-4748 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-4748?
CVE-2025-4748 affects Erlang OTP.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.