Skip to main content

Erlang OTP CVE-2026-47078

| EUVDEUVD-2026-49317 MEDIUM
Relative Path Traversal (CWE-23)
2026-07-27 EEF
Path Traversal Otp Erlang
4.8
CVSS 4.0 · Vendor: EEF
Share

Severity by source

Vendor (EEF) PRIMARY
4.8 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.4 MEDIUM

Local attack vector, no privileges, user interaction required, low integrity and availability impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
SUSE
5.0 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
Red Hat
4.4 MEDIUM
qualitative

Primary rating from Vendor (EEF).

CVSS VectorVendor: EEF

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Jul 27, 2026 - 15:52 vuln.today
Analysis Generated
Jul 27, 2026 - 15:52 vuln.today
CVE Published
Jul 27, 2026 - 15:03 cve.org
MEDIUM 4.8

DescriptionCVE.org

Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive.

zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks directory depth as a running integer counter: .. decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as ../x/y causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via add_cwd.

This vulnerability is associated with program file lib/stdlib/src/zip.erl.

This issue affects OTP from OTP 27.1 before 27.3.4.15, 28.5.0.4, and 29.0.4 corresponding to stdlib from 6.1 before 6.2.2.4, 7.3.0.1, and 8.0.3.

AnalysisAI

Path traversal vulnerability in Erlang OTP's stdlib zip module allows attackers to write files outside the intended extraction directory by exploiting flawed validation of relative paths in zip archives. Affected are OTP versions 27.1 before 27.3.4.15, 28.5.0.4, and 29.0.4. Successful exploitation requires user interaction (extracting a crafted zip) and has limited impact on integrity and availability; no active exploitation has been reported.

Technical ContextAI

The vulnerability resides in the zip:unzip/1,2 and zip:extract/1,2 functions of Erlang's standard library (stdlib). The affected check_dir_level/2 function validates entry paths by tracking directory depth as a running integer: '..' decrements it, normal components increment it, and the caller only rejects paths where the final depth is negative. A path like ../x/y causes the counter to go negative mid-traversal and then recover to zero, passing validation while resolving to a location outside the extraction directory when combined with the current working directory. The flaw triggers a CWE-23 Relative Path Traversal. The CPE string cpe:2.3:a:erlang:otp:*:*:*:*:*:*:*:* confirms the affected product is the Erlang OTP runtime.

RemediationAI

Apply the vendor-provided patch by upgrading to Erlang OTP version 27.3.4.15, 28.5.0.4, or 29.0.4, depending on the deployed major version. The fix is available via a commit at https://github.com/erlang/otp/commit/8a933c9c7835b06776d31d17b79b7336627d887a. As a workaround, avoid using zip:unzip/1,2 or zip:extract/1,2 on untrusted zip archives; alternatively, pre-validate extracted file paths externally before writing. No other compensating controls are suggested by the vendor.

More in Otp

View all
CVE-2022-24584 MEDIUM POC
6.5 May 11

Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation
CVE-2026-89422 CRITICAL
9.3 Sep 22

Erlang/OTP's ssl application in affected releases (OTP 22.2 through the fixed 27.3.4.18, 28.5.0.7 and 29.1.1) will compl
CVE-2026-55953 CRITICAL
9.1 Jul 27

An on-path attacker can force an Erlang/OTP TLS 1.2 or DTLS client to accept an anonymous cipher suite not offered by th
CVE-2026-49759 HIGH
8.8 Jun 10

Denial of service in Erlang/OTP erts (inet_drv SCTP handler) lets unauthenticated remote attackers crash the BEAM VM by

CVE-2026-70399 HIGH
8.7 Sep 01

Unauthenticated denial of service in Erlang/OTP's inets httpd allows any remote attacker to exhaust a server's process p
CVE-2026-55950 HIGH
8.7 Jul 02

Remote denial of service in Erlang/OTP's ssl application (dtls_packet_demux module) lets an unauthenticated attacker cra
CVE-2026-71380 HIGH
8.7 Sep 01

Erlang/OTP's inets HTTP server (httpd) is vulnerable to a slow-body resource exhaustion attack exploitable by unauthenti
CVE-2026-58227 HIGH
8.7 Jul 27

Uncontrolled recursion in the Erlang/OTP ssl application when processing a crafted TLS/DTLS certificate chain allows rem
CVE-2026-74835 HIGH
8.7 Sep 01

Erlang/OTP's inets HTTP server (httpd) fails to enforce an administrator-configured request body-size limit when process
CVE-2026-59250 HIGH
8.3 Jul 27

Remote code execution and denial of service are possible against Erlang/OTP nodes that run the megaco application with t
CVE-2026-73276 HIGH
8.3 Sep 01

Remote unauthenticated attackers can exploit Erlang/OTP's built-in inets HTTP server across OTP versions 22.2 through 29
CVE-2026-66357 HIGH
8.3 Sep 01

HTTP request smuggling in Erlang/OTP's built-in inets httpd server allows unauthenticated remote attackers to inject arb

Same weakness CWE-23 – Relative Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2024-27199 HIGH POC
7.3
CVE-2025-34510 HIGH POC
8.8
CVE-2026-34926 MEDIUM POC
6.7
CVE-2024-24578 CRITICAL POC
9.8
CVE-2025-52207 CRITICAL POC
9.9
CVE-2023-6825 CRITICAL POC
9.9
CVE-2022-1373 HIGH POC
7.2

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-47078 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy