Vulnerability · Published Jun 16, 2025 · Assigned by EEF
CVE-2025-4748Absolute path traversal in zip:unzip/1,2
Medium 4.8
In plain English
A medium-severity path traversal in OTP from Erlang. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2 unless the memory option is passed. This issue affects OTP from OTP 17.0 before OTP 28.0.1, OTP 27.3.4.1 and OTP 26.2.5.13, corresponding to stdlib from 2.0 before 7.0.1, 6.2.2.1 and 5.2.3.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | erlang | 1:25.2.3+dfsg-1+deb12u2 | DEBIAN-CVE-2025-4748 |
| Debian:13 | erlang | 1:27.3.4.1+dfsg-1 | DEBIAN-CVE-2025-4748 |
| Debian:14 | erlang | 1:27.3.4.1+dfsg-1 | DEBIAN-CVE-2025-4748 |
| Ubuntu:22.04:LTS | erlang | 1:24.2.1+dfsg-1ubuntu0.5 | USN-7656-1 |
| Ubuntu:22.04:LTS | erlang | 1:24.2.1+dfsg-1ubuntu0.8 | USN-8901-1 |
| Ubuntu:22.04:LTS | erlang | 1:24.2.1+dfsg-1ubuntu0.5 | UBUNTU-CVE-2025-4748 |
| Ubuntu:24.04:LTS | erlang | 1:25.3.2.8+dfsg-1ubuntu4.8 | USN-8901-1 |
| Ubuntu:24.04:LTS | erlang | 1:25.3.2.8+dfsg-1ubuntu4.4 | USN-7656-1 |
| Ubuntu:24.04:LTS | erlang | 1:25.3.2.8+dfsg-1ubuntu4.4 | UBUNTU-CVE-2025-4748 |
| Ubuntu:25.10 | erlang | 1:27.3.4.1+dfsg-1 | UBUNTU-CVE-2025-4748 |
| Ubuntu:26.04:LTS | erlang | 1:27.3.4.6+dfsg-1ubuntu0.2 | USN-8901-1 |
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
References
- https://github.com/erlang/otp/security/advisories/GHSA-9g37-pgj9-wrhc vendor-advisory, related
- https://cna.erlef.org/cves/CVE-2025-4748.html related
- https://osv.dev/vulnerability/EEF-CVE-2025-4748 related
- https://www.erlang.org/doc/system/versions.html#order-of-versions x_version-scheme
- https://github.com/erlang/otp/pull/9941 patch
- https://github.com/erlang/otp/commit/5a55feec10c9b69189d56723d8f237afa58d5d4f patch
- https://github.com/erlang/otp/commit/ba2f2bc5f45fcfd2d6201ba07990a678bbf4cc8f patch
- https://github.com/erlang/otp/commit/578d4001575aa7647ea1efd4b2b7e3afadcc99a5 patch
- http://www.openwall.com/lists/oss-security/2025/06/16/5