CVE-2026-47078: Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass
Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive.
zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:checkdirlevel/2, which tracks directory depth as a running integer counter: .. decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as ../x/y causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via addcwd.
This vulnerability is associated with program file lib/stdlib/src/zip.erl.
This issue affects OTP from OTP 27.1 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to stdlib from 6.1 before 8.0.3, 7.3.0.1 and 6.2.2.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Erlang OTP (stdlib zip module)to a version that resolves this vulnerability.Fixed in 29.0.4 - Upgrade
Upgrade
Erlang OTP (stdlib zip module)to a version that resolves this vulnerability.Fixed in 28.5.0.4 - Upgrade
Upgrade
Erlang OTP (stdlib zip module)to a version that resolves this vulnerability.Fixed in 27.3.4.15 - Upgrade
Upgrade
stdlib zip moduleto a version that resolves this vulnerability.Fixed in 8.0.3 - Upgrade
Upgrade
stdlib zip moduleto a version that resolves this vulnerability.Fixed in 7.3.0.1 - Upgrade
Upgrade
stdlib zip moduleto a version that resolves this vulnerability.Fixed in 6.2.2.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47078?
CVE-2026-47078 has a risk score of 62, indicating a medium level of severity.
How do I fix CVE-2026-47078?
To fix CVE-2026-47078, update to the latest version of Erlang/OTP that addresses the vulnerability.
What does CVE-2026-47078 involve?
CVE-2026-47078 involves a relative path traversal vulnerability in the zip module of Erlang OTP allowing file writes outside the intended extraction directory.
Which versions of Erlang/OTP are affected by CVE-2026-47078?
CVE-2026-47078 affects certain versions of Erlang/OTP prior to the fix implemented for this vulnerability.
How can CVE-2026-47078 be exploited?
CVE-2026-47078 can be exploited by crafting a malicious zip archive that allows directory depth circumvention during extraction.