CVE-2025-4748: Absolute path traversal in zip:unzip/1,2
Absolute path traversal in zip:unzip/1,2
Other sources
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2 unless the memory option is passed. This issue affects OTP from OTP 17.0 before OTP 28.0.1, OTP 27.3.4.1 and OTP 26.2.5.13, corresponding to stdlib from 2.0 before 7.0.1, 6.2.2.1 and 5.2.3.4.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.2.5.13-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 25.3.2.21-2 - Upgrade
Upgrade
ubuntu/erlangto a version that resolves this vulnerability.Fixed in 1:18.3-dfsg-1ubuntu3.1+esm4 - Upgrade
Upgrade
ubuntu/erlangto a version that resolves this vulnerability.Fixed in 1:20.2.2+dfsg-1ubuntu2+esm4 - Upgrade
Upgrade
ubuntu/erlangto a version that resolves this vulnerability.Fixed in 1:22.2.7+dfsg-1ubuntu0.5+esm3 - Upgrade
Upgrade
ubuntu/erlangto a version that resolves this vulnerability.Fixed in 1:24.2.1+dfsg-1ubuntu0.5 - Upgrade
Upgrade
ubuntu/erlangto a version that resolves this vulnerability.Fixed in 1:25.3.2.8+dfsg-1ubuntu4.4 - Upgrade
Upgrade
ubuntu/erlangto a version that resolves this vulnerability.Fixed in 1:27.3.4.1+dfsg-1 - Upgrade
Upgrade
debian/erlangto a version that resolves this vulnerability.Fixed in 1:25.2.3+dfsg-1+deb12u4Fixed in 1:27.3.4.1+dfsg-1+deb13u3Fixed in 1:27.3.4.1+dfsg-1+deb13u4Fixed in 1:29.1.1+dfsg-1Fixed in 1:29.1.2+dfsg-1 - Upgrade
Upgrade
Erlang/OTPto a version that resolves this vulnerability.Fixed in 28.0.1 - Upgrade
Upgrade
Erlang/OTPto a version that resolves this vulnerability.Fixed in 27.3.4.1 - Upgrade
Upgrade
Erlang/OTPto a version that resolves this vulnerability.Fixed in 26.2.5.13
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4748?
CVE-2025-4748 has a high severity rating due to the potential for absolute path traversal and file manipulation.
How do I fix CVE-2025-4748?
To fix CVE-2025-4748, upgrade to the latest version of Erlang OTP and stdlib that address this vulnerability.
Which versions of Erlang OTP are affected by CVE-2025-4748?
CVE-2025-4748 affects Erlang OTP versions from 17.0 to 28.0.1.
What types of vulnerabilities are associated with CVE-2025-4748?
CVE-2025-4748 is associated with a path traversal vulnerability that allows manipulation of files.
Which components are specifically impacted by CVE-2025-4748?
CVE-2025-4748 specifically impacts the zip.erl module within the Erlang standard library.