CVE-2026-47078 Details
Description
Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks directory depth as a running integer counter: .. decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as ../x/y causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via add_cwd. This vulnerability is associated with program file lib/stdlib/src/zip.erl. This issue affects OTP from OTP 27.1 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to stdlib from 6.1 before 6.2.2.4, 7.3.0.1, and 8.0.3.
A relative path traversal vulnerability has been identified in the zip module of Erlang OTP. This issue allows files to be written outside the intended extraction directory by exploiting how the zip:unzip and zip:extract functions validate entry paths. The vulnerability arises because the zip:check_dir_level function, which tracks directory depth, can be manipulated by crafted zip archive entries to bypass validation. As a result, files can be extracted to locations outside the designated directory, potentially leading to unauthorized file access or modification.
Users can upgrade to Erlang OTP versions 29.0.4, 28.5.0.4, or 27.3.4.15 to address this vulnerability. For those using the stdlib library, versions 8.0.3, 7.3.0.1, or 6.2.2.4 are recommended.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-23 | Relative Path Traversal | EEF |
Affected Products
No affected product data is available for this CVE.
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | EEF |
| Jul 27, 2026 | CVE Modified | CISA-ADP |
| Jul 27, 2026 | New CVE Received | EEF |