Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass
Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks directory depth as a running integer counter: .. decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as ../x/y causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via add_cwd. This vulnerability is associated with program file lib/stdlib/src/zip.erl. This issue affects OTP from OTP 27.1 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to stdlib from 6.1 before 6.2.2.4, 7.3.0.1, and 8.0.3.
CVE-2026-47078
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-47078
OTP
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
OTP
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
OTP
Source reference: /containers/cna/affected/2/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"vendor": "Erlang",
"modules": [
"zip"
],
"product": "OTP",
"versions": [
{
"status": "affected",
"changes": [
{
"at": "27.3.4.15",
"status": "unaffected"
},
{
"at": "28.5.0.4",
"status": "unaffected"
},
{
"at": "29.0.4",
"status": "unaffected"
}
],
"version": "27.1",
"lessThan": "*",
"versionType": "otp"
}
],
"packageURL": "pkg:software-id/erlang.org/otp",
"packageName": "otp",
"programFiles": [
"lib/stdlib/src/zip.erl"
],
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "zip:unzip/1"
},
{
"name": "zip:unzip/2"
},
{
"name": "zip:extract/1"
},
{
"name": "zip:extract/2"
},
{
"name": "zip:check_dir_level/2"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"modules": [
"zip"
],
"product": "OTP",
"versions": [
{
"status": "affected",
"changes": [
{
"at": "6.2.2.4",
"status": "unaffected"
},
{
"at": "7.3.0.1",
"status": "unaffected"
},
{
"at": "8.0.3",
"status": "unaffected"
}
],
"version": "6.1",
"lessThan": "*",
"versionType": "otp"
}
],
"packageURL": "pkg:otp/stdlib?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"packageName": "stdlib",
"programFiles": [
"src/zip.erl"
],
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "zip:unzip/1"
},
{
"name": "zip:unzip/2"
},
{
"name": "zip:extract/1"
},
{
"name": "zip:extract/2"
},
{
"name": "zip:check_dir_level/2"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"modules": [
"zip"
],
"product": "OTP",
"versions": [
{
"status": "affected",
"version": "8d537f51a4262d24f3395c4148323eaca9facbbd",
"lessThan": "8a933c9c7835b06776d31d17b79b7336627d887a",
"versionType": "git"
}
],
"packageURL": "pkg:github/erlang/otp",
"packageName": "erlang/otp",
"programFiles": [
"lib/stdlib/src/zip.erl"
],
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "zip:unzip/1"
},
{
"name": "zip:unzip/2"
},
{
"name": "zip:extract/1"
},
{
"name": "zip:extract/2"
},
{
"name": "zip:check_dir_level/2"
}
]
}
]- Related CVEs
- CVE-2026-47078
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #1894 · Revision 1
- Added to Heist Feed
- Publisher date