CVE-2025-4748 Absolute path traversal in zip:unzip/1,2
Attackers can exploit path traversal in Erlang OTP zip functions to read or modify files outside the intended directory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-4748?
CVE-2025-4748 is a medium-severity path traversal vulnerability in Erlang OTP, published on 16 Jun 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2 unless the memory option is passed.
This issue affects OTP from OTP 17.0 before OTP 28.0.1, OTP 27.3.4.1 and OTP 26.2.5.13, corresponding to stdlib from 2.0 before 7.0.1, 6.2.2.1 and 5.2.3.4.
Weakness: CWE-22
Which versions are affected by CVE-2025-4748?
Linux distribution packages (6)
erlang SUSE:Linux Enterprise Module for Server Applications 15 SP6 | All versions | 23.3.4.19-150300.3.23.3 |
erlang26 SUSE:Linux Enterprise Module for Server Applications 15 SP6 | All versions | 26.2.1-150300.7.14.3 |
erlang SUSE:Linux Enterprise Module for Server Applications 15 SP7 | All versions | 23.3.4.19-150300.3.23.3 |
erlang26 SUSE:Linux Enterprise Module for Server Applications 15 SP7 | All versions | 26.2.1-150300.7.14.3 |
erlang openSUSE:Leap 15.6 | All versions | 23.3.4.19-150300.3.23.3 |
erlang26 openSUSE:Leap 15.6 | All versions | 26.2.1-150300.7.14.3 |
How do I fix CVE-2025-4748?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-4748 being exploited?
There is no known exploitation of CVE-2025-4748 in the wild and no public exploit code.
Sources
Also known as AZL-64068, AZL-64073, DEBIAN-CVE-2025-4748, EEF-CVE-2025-4748, GHSA-9g37-pgj9-wrhc, OESA-2025-1767 and 3 more.