CVE-2026-47078
Full vulnerability record from the local CVENow database.
Description
Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks directory depth as a running integer counter: .. decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as ../x/y causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via add_cwd. This vulnerability is associated with program file lib/stdlib/src/zip.erl. This issue affects OTP from OTP 27.1 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to stdlib from 6.1 before 6.2.2.4, 7.3.0.1, and 8.0.3.
Severity
MEDIUM
CVSS score
4.8
(v4.0)
Vulnerability status
Awaiting Analysis
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-07-27 16:17:07.643000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON
{
"id": "CVE-2026-47078",
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"published": "2026-07-27T16:17:07.643",
"lastModified": "2026-10-24T13:10:00.147",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive.\n\nzip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks directory depth as a running integer counter: .. decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as ../x/y causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via add_cwd.\n\nThis vulnerability is associated with program file lib/stdlib/src/zip.erl.\n\nThis issue affects OTP from OTP 27.1 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to stdlib from 6.1 before 6.2.2.4, 7.3.0.1, and 8.0.3."
},
{
"lang": "es",
"value": "Vulnerabilidad de salto de ruta relativo en Erlang OTP (módulo zip de stdlib) permite escribir archivos fuera del directorio de extracción previsto mediante un archivo zip manipulado.\n\nzip:unzip/1,2 y zip:extract/1,2 validan las rutas de entrada usando zip:check_dir_level/2, que rastrea la profundidad del directorio como un contador entero en ejecución: .. lo decrementa, los componentes de ruta normales lo incrementan. El llamador rechaza solo las rutas donde el valor final del contador es menor que cero. Una ruta como .. / x/y hace que el contador se vuelva negativo a mitad del recorrido y luego se recupere a cero, pasando la validación mientras se resuelve a una ubicación fuera del directorio de extracción cuando se une con el directorio de trabajo actual a través de add_cwd.\n\nEsta vulnerabilidad está asociada con el archivo de programa lib/stdlib/src/zip.erl.\n\nEste problema afecta a OTP desde OTP 27.1 antes de OTP 29.0.4, OTP 28.5.0.4 y OTP 27.3.4.15, correspondiendo a stdlib desde 6.1 antes de 8.0.3, 7.3.0.1 y 6.2.2.4."
}
],
"affected": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"affectedData": [
{
"vendor": "Erlang",
"product": "OTP",
"defaultStatus": "unaffected",
"packageName": "otp",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"modules": [
"zip"
],
"programFiles": [
"lib/stdlib/src/zip.erl"
],
"programRoutines": [
{
"name": "zip:unzip/1"
},
{
"name": "zip:unzip/2"
},
{
"name": "zip:extract/1"
},
{
"name": "zip:extract/2"
},
{
"name": "zip:check_dir_level/2"
}
],
"packageURL": "pkg:software-id/erlang.org/otp",
"versions": [
{
"version": "27.1",
"lessThan": "*",
"versionType": "otp",
"status": "affected",
"changes": [
{
"at": "27.3.4.15",
"status": "unaffected"
},
{
"at": "28.5.0.4",
"status": "unaffected"
},
{
"at": "29.0.4",
"status": "unaffected"
}
]
}
]
},
{
"vendor": "Erlang",
"product": "OTP",
"defaultStatus": "unaffected",
"packageName": "stdlib",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"modules": [
"zip"
],
"programFiles": [
"src/zip.erl"
],
"programRoutines": [
{
"name": "zip:unzip/1"
},
{
"name": "zip:unzip/2"
},
{
"name": "zip:extract/1"
},
{
"name": "zip:extract/2"
},
{
"name": "zip:check_dir_level/2"
}
],
"repo": "https://github.com/erlang/otp",
"packageURL": "pkg:otp/stdlib?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"versions": [
{
"version": "6.1",
"lessThan": "*",
"versionType": "otp",
"status": "affected",
"changes": [
{
"at": "6.2.2.4",
"status": "unaffected"
},
{
"at": "7.3.0.1",
"status": "unaffected"
},
{
"at": "8.0.3",
"status": "unaffected"
}
]
}
]
},
{
"vendor": "Erlang",
"product": "OTP",
"defaultStatus": "unaffected",
"collectionURL": "https://github.com",
"packageName": "erlang/otp",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"modules": [
"zip"
],
"programFiles": [
"lib/stdlib/src/zip.erl"
],
"programRoutines": [
{
"name": "zip:unzip/1"
},
{
"name": "zip:unzip/2"
},
{
"name": "zip:extract/1"
},
{
"name": "zip:extract/2"
},
{
"name": "zip:check_dir_level/2"
}
],
"repo": "https://github.com/erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"versions": [
{
"version": "8d537f51a4262d24f3395c4148323eaca9facbbd",
"lessThan": "8a933c9c7835b06776d31d17b79b7336627d887a",
"versionType": "git",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "LOW",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-27T18:38:46.508080Z",
"id": "CVE-2026-47078",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-23"
}
]
}
],
"references": [
{
"url": "https://cna.erlef.org/cves/CVE-2026-47078.html",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://github.com/erlang/otp/commit/8a933c9c7835b06776d31d17b79b7336627d887a",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://github.com/erlang/otp/commit/8d537f51a4262d24f3395c4148323eaca9facbbd",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://github.com/erlang/otp/security/advisories/GHSA-rf72-wp7h-jg3x",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-47078",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
]
}