Skip to main content

Erlang OTP EUVDEUVD-2025-18414

| CVE-2025-4748 MEDIUM
Path Traversal (CWE-22)
2025-06-16 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Path Traversal
4.8
CVSS 4.0 · Vendor: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Share

Severity by source

Vendor (6b3ad84c-e1a6-4bf7-a703-f496b71e49db) PRIMARY
4.8 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.4 MEDIUM

Local attack requiring user interaction (UI:R), no privileges, limited integrity and availability impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
Ubuntu
MEDIUM
qualitative
SUSE
4.4 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Primary rating from Vendor (6b3ad84c-e1a6-4bf7-a703-f496b71e49db).

CVSS VectorVendor: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 26, 2026 - 12:44 vuln.today
Analysis Generated
Jul 26, 2026 - 12:44 vuln.today
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 14, 2026 - 21:59 euvd
EUVD-2025-18414
CVE Published
Jun 16, 2025 - 11:15 nvd
MEDIUM 4.8

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2 unless the memory option is passed.

This issue affects OTP from OTP 17.0 until OTP 28.0.1, OTP 27.3.4.1 and OTP 26.2.5.13, corresponding to stdlib from 2.0 until 7.0.1, 6.2.2.1 and 5.2.3.4.

AnalysisAI

Path traversal in Erlang/OTP's stdlib zip functions allows an attacker to write files to arbitrary locations on the filesystem when extracting a crafted archive. Affected are all OTP versions from 17.0 to 28.0.1 (and specific patch releases) when using zip:unzip/1,2 or zip:extract/1,2 without the memory option. The vulnerability requires user interaction and local file access, with no public exploits identified and a low EPSS score of 0.08%.

Technical ContextAI

The vulnerability is a classic path traversal (CWE-22) in the zip.erl module of Erlang/OTP's standard library. The functions zip:unzip/1,2 and zip:extract/1,2 did not sanitize absolute paths from zip archive entries, allowing a crafted archive to write files outside the intended extraction directory. The fix introduces a sanitize_filename/1 function that converts absolute paths to relative ones, and the memory option (which extracts to memory instead of disk) is not affected. The affected products include the Erlang/OTP runtime, with the stdlib version ranges 2.0-7.0.1, 6.2.2.1, and 5.2.3.4.

RemediationAI

Upgrade to a fixed OTP version: 28.0.2 or later, 27.3.4.2 or later, or 26.2.5.14 or later. The fix is included in commits 578d400, 5a55fee, and ba2f2bc. If an immediate upgrade is not possible, workarounds include using the memory option when calling zip:unzip/2 or zip:extract/2 (e.g., zip:unzip(Archive, [memory])), which extracts files to memory instead of disk. Side effect: memory extraction may not be suitable for large archives. Restrict access to untrusted zip files or manually sanitize extraction paths.

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

Ubuntu

Priority: Medium
erlang
Release Status Version
trusty needs-triage -
xenial needs-triage -
bionic needs-triage -
focal needs-triage -
oracular ignored end of life, was needs-triage
jammy released 1:24.2.1+dfsg-1ubuntu0.5
upstream released 1:27.3.4.1+dfsg-1
noble released 1:25.3.2.8+dfsg-1ubuntu4.4
plucky released 1:27.3+dfsg-1ubuntu1.2
questing released 1:27.3.4.1+dfsg-1
USN-7656-1

Debian

Bug #1107939
erlang
Release Status Fixed Version Urgency
bullseye fixed 1:23.2.6+dfsg-1+deb11u3 -
bullseye (security) fixed 1:23.2.6+dfsg-1+deb11u3 -
bookworm fixed 1:25.2.3+dfsg-1+deb12u2 -
bookworm (security) vulnerable 1:25.2.3+dfsg-1+deb12u1 -
trixie fixed 1:27.3.4.1+dfsg-1+deb13u1 -
forky fixed 1:27.3.4.6+dfsg-1 -
sid fixed 1:27.3.4.8+dfsg-1 -
(unstable) fixed 1:27.3.4.1+dfsg-1 -
DLA-4376-1

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise Module for Server Applications 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
openSUSE Leap 15.6 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2025-18414 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy