CVE-2025-4748: Absolute path traversal in zip:unzip/1,2

Login Request a demo

Medium severity · published Jun 16, 2025

CVE-2025-4748

Absolute path traversal in zip:unzip/1,2

4.8

CVSS

0.3%

EPSS

No

On KEV

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2 unless the memory option is passed. This issue affects OTP from OTP 17.0 before OTP 28.0.1, OTP 27.3.4.1 and OTP 26.2.5.13, corresponding to stdlib from 2.0 before 7.0.1, 6.2.2.1 and 5.2.3.4.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 22% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

OT

OTP · Erlang

2.0; 17.0; 07b8f441ca711f9812fad9e9115bab3c3aa92f79 · source: vendor

Affected product