oss-security - CVE-2025-4748: Erlang/OTP 17.0–28.0.0 absolute-path traversal in zip:unzip/zip:extract

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CACupubOH0Lbk0f001JiFmdCn6mCvgUZ14KR2RUrVXK--7fyffg@mail.gmail.com>
Date: Mon, 16 Jun 2025 17:33:37 +0200
From: Jonatan Männchen <jonatan@...nnchen.ch>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-4748: Erlang/OTP 17.0–28.0.0 absolute-path traversal in zip:unzip/zip:extract

Hi all,

An absolute-path traversal flaw has been found in the Erlang/OTP
standard-library ZIP routines `zip:unzip/1,2` and `zip:extract/1,2`.
If the caller does **not** supply the `memory` option, archive entries whose
file names start with "/" are written to disk verbatim. An attacker can
therefore create or overwrite arbitrary files writable by the Erlang VM. The
issue is tracked as **CVE-2025-4748**.

### Affected releases

* 17.0 up to 28.0.0 (fixed in 28.0.1)
* 27.x up to 27.3.4 (fixed in 27.3.4.1)
* 26.x up to 26.2.5 (fixed in 26.2.5.13)

### Impact

When the zip module is used to extract files to disk and the archive is
maliciously corrupted by including absolute file paths, the zip module would
extract them as absolute paths instead of stripping the leading /, drive or
device letter.

This vulnerability is associated with program files `lib/stdlib/src/zip.erl` and
program routines `zip:unzip/1`, `zip:unzip/2`, `zip:extract/1`, `zip:extract/2`
unless the `memory` option is passed.

### Mitigation / Fix

Upgrade to one of the fixed releases listed above, or cherry-pick the upstream
patch. The patch is available in unified diff form at:

https://patch-diff.githubusercontent.com/raw/erlang/otp/pull/9941.patch

Until you can upgrade, you have two work-arounds:

1. Pass the `memory` option and perform your own validation before writing files
to disk.
2. Call `zip:list_dir/1` first, reject archives that contain absolute paths,
then proceed with extraction.

### Credits

* Reported by **Wander Nauta**
* Patch by **Lukas Backström**
* Reviewed by **Björn Gustavsson**

### References

* Vendior advisory:
https://github.com/erlang/otp/security/advisories/GHSA-9g37-pgj9-wrhc
* CNA Advisory: https://cna.erlef.org/cves/cve-2025-4748.html
* CVE record: https://cve.org/CVERecord?id=CVE-2025-4748
* Patch PR: https://github.com/erlang/otp/pull/9941

Best Regards,
Jonatan Männchen
CISO @ Erlang Ecosystem Foundation

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.