CVE-2026-47078
Received Received - Intake

Relative Path Traversal in Erlang OTP zip Module

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: EEF

Description
Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks directory depth as a running integer counter: .. decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as ../x/y causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via add_cwd. This vulnerability is associated with program file lib/stdlib/src/zip.erl. This issue affects OTP from OTP 27.1 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to stdlib from 6.1 before 8.0.3, 7.3.0.1 and 6.2.2.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-47078
EUVD
EUVD-2026-49317

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
erlang otp to 29.0.4 (exc)
erlang otp 28.5.0.4
erlang otp 27.3.4.15
erlang stdlib to 8.0.3 (exc)
erlang stdlib 7.3.0.1
erlang stdlib 6.2.2.4
erlang otp From 27.1 (inc) to 29.0.4 (exc)
erlang otp to 8.0.3 (exc)
erlang otp to 7.3.0.1 (exc)
erlang otp to 6.2.2.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-23 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-47078 is a relative path traversal vulnerability in Erlang OTP's zip module. It affects functions like zip:unzip/1,2 and zip:extract/1,2. The issue occurs because the zip:check_dir_level/2 function validates paths by tracking directory depth with a counter. A crafted zip archive with paths like ../x/y can trick the counter into going negative and then recovering to zero, bypassing validation. This allows writing files outside the intended extraction directory.

Detection Guidance

To detect this vulnerability, inspect Erlang OTP versions for affected releases (27.1 to 29.0.3, 28.5.0.3, 27.3.4.14). Check for unusual file writes or modifications in extraction directories. Use commands like 'erl -eval "io:format("~s~n", [erlang:system_info(otp_release)])".' to verify OTP version. Monitor logs for zip extraction operations with suspicious paths.

Impact Analysis

An attacker could exploit this to overwrite scripts, configuration files, or shared libraries. This may lead to remote code execution or data corruption. The impact depends on the privileges of the affected application and the files it can access.

Compliance Impact

This vulnerability could lead to unauthorized file writes outside intended directories, potentially exposing sensitive data or system files. For GDPR, this may result in unauthorized access to personal data, violating Article 32 (security of processing). For HIPAA, it could allow unauthorized access to protected health information, violating the Security Rule's integrity and access controls.

Mitigation Strategies

Upgrade Erlang OTP to patched versions (27.3.4.15, 28.5.0.4, or 29.0.4). If upgrading is not possible, avoid using zip:unzip/1,2 and zip:extract/1,2 functions with untrusted archives. Implement strict input validation for zip file paths. Monitor for signs of exploitation such as unexpected file writes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47078. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart