{ "cvss": 4.8, "datePublished": "2026-07-27T16:17:07.643", "dateUpdated": "2026-10-24T13:10:00.147", "description": "Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive.\n\nzip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks directory depth as a running integer counter: .. decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as ../x/y causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via add_cwd.\n\nThis vulnerability is associated with program file lib/stdlib/src/zip.erl.\n\nThis issue affects OTP from OTP 27.1 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to stdlib from 6.1 before 6.2.2.4, 7.3.0.1, and 8.0.3.", "id": "CVE-2026-47078", "raw": { "affected": [ { "affectedData": [ { "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "modules": [ "zip" ], "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "programFiles": [ "lib/stdlib/src/zip.erl" ], "programRoutines": [ { "name": "zip:unzip/1" }, { "name": "zip:unzip/2" }, { "name": "zip:extract/1" }, { "name": "zip:extract/2" }, { "name": "zip:check_dir_level/2" } ], "vendor": "Erlang", "versions": [ { "changes": [ { "at": "27.3.4.15", "status": "unaffected" }, { "at": "28.5.0.4", "status": "unaffected" }, { "at": "29.0.4", "status": "unaffected" } ], "lessThan": "*", "status": "affected", "version": "27.1", "versionType": "otp" } ] }, { "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "modules": [ "zip" ], "packageName": "stdlib", "packageURL": "pkg:otp/stdlib?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": [ "src/zip.erl" ], "programRoutines": [ { "name": "zip:unzip/1" }, { "name": "zip:unzip/2" }, { "name": "zip:extract/1" }, { "name": "zip:extract/2" }, { "name": "zip:check_dir_level/2" } ], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [ { "changes": [ { "at": "6.2.2.4", "status": "unaffected" }, { "at": "7.3.0.1", "status": "unaffected" }, { "at": "8.0.3", "status": "unaffected" } ], "lessThan": "*", "status": "affected", "version": "6.1", "versionType": "otp" } ] }, { "collectionURL": "https://github.com", "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "modules": [ "zip" ], "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": [ "lib/stdlib/src/zip.erl" ], "programRoutines": [ { "name": "zip:unzip/1" }, { "name": "zip:unzip/2" }, { "name": "zip:extract/1" }, { "name": "zip:extract/2" }, { "name": "zip:check_dir_level/2" } ], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [ { "lessThan": "8a933c9c7835b06776d31d17b79b7336627d887a", "status": "affected", "version": "8d537f51a4262d24f3395c4148323eaca9facbbd", "versionType": "git" } ] } ], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive.\n\nzip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks directory depth as a running integer counter: .. decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as ../x/y causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via add_cwd.\n\nThis vulnerability is associated with program file lib/stdlib/src/zip.erl.\n\nThis issue affects OTP from OTP 27.1 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to stdlib from 6.1 before 6.2.2.4, 7.3.0.1, and 8.0.3." }, { "lang": "es", "value": "Vulnerabilidad de salto de ruta relativo en Erlang OTP (módulo zip de stdlib) permite escribir archivos fuera del directorio de extracción previsto mediante un archivo zip manipulado.\n\nzip:unzip/1,2 y zip:extract/1,2 validan las rutas de entrada usando zip:check_dir_level/2, que rastrea la profundidad del directorio como un contador entero en ejecución: .. lo decrementa, los componentes de ruta normales lo incrementan. El llamador rechaza solo las rutas donde el valor final del contador es menor que cero. Una ruta como .. / x/y hace que el contador se vuelva negativo a mitad del recorrido y luego se recupere a cero, pasando la validación mientras se resuelve a una ubicación fuera del directorio de extracción cuando se une con el directorio de trabajo actual a través de add_cwd.\n\nEsta vulnerabilidad está asociada con el archivo de programa lib/stdlib/src/zip.erl.\n\nEste problema afecta a OTP desde OTP 27.1 antes de OTP 29.0.4, OTP 28.5.0.4 y OTP 27.3.4.15, correspondiendo a stdlib desde 6.1 antes de 8.0.3, 7.3.0.1 y 6.2.2.4." } ], "id": "CVE-2026-47078", "lastModified": "2026-10-24T13:10:00.147", "metrics": { "cvssMetricV40": [ { "cvssData": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2026-47078", "options": [ { "exploitation": "none" }, { "automatable": "no" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2026-07-27T18:38:46.508080Z", "version": "2.0.3" } } ] }, "published": "2026-07-27T16:17:07.643", "references": [ { "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-47078.html" }, { "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/commit/8a933c9c7835b06776d31d17b79b7336627d887a" }, { "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/commit/8d537f51a4262d24f3395c4148323eaca9facbbd" }, { "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/security/advisories/GHSA-rf72-wp7h-jg3x" }, { "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-47078" }, { "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" } ], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Awaiting Analysis", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-23" } ], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary" } ] }, "severity": "MEDIUM", "source": "nvd", "title": "Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended ext..." }