https://seclists.org/oss-sec/2025/q2/256: CVE-2025-4748: Erlang/OTP 17.0–28.0.0 absolute-path traversal in zip:unzip/zip:extract
Published Jun 16, 2025
·Updated
Affected Software
3 affected components
Erlang/OTP Erlang/OTP>=17.0<28.0.0
Erlang/OTP Erlang/OTP>=27.0<27.3.4
Erlang/OTP Erlang/OTP>=26.0<26.2.5
Frequently Asked Questions
1
What is the severity of CVE-2025-4748?
CVE-2025-4748 has been assessed as a high severity vulnerability due to the potential for absolute-path traversal attacks.
2
How do I fix CVE-2025-4748?
To fix CVE-2025-4748, users should update to a version of Erlang/OTP where the vulnerability has been addressed, ensuring they provide the 'memory' option in ZIP routine calls.
3
What versions of Erlang/OTP are affected by CVE-2025-4748?
CVE-2025-4748 affects Erlang/OTP versions 17.0 through 28.0.0.
4
What are the potential consequences of exploiting CVE-2025-4748?
Exploitation of CVE-2025-4748 could allow an attacker to write arbitrary files to the filesystem, leading to data compromise or system integrity issues.
5
Is there a workaround for CVE-2025-4748 if I cannot update?
A potential workaround for CVE-2025-4748 is to ensure that the 'memory' option is supplied when using the affected ZIP routines to prevent absolute paths from being written.