CVE-2026-47078 in OTP
Summary
by MITRE • 07/27/2026
Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive.
zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks directory depth as a running integer counter: .. decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as ../x/y causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via add_cwd.
This vulnerability is associated with program file lib/stdlib/src/zip.erl.
This issue affects OTP from OTP 27.1 before 27.3.4.15, 28.5.0.4, and 29.0.4 corresponding to stdlib from 6.1 before 6.2.2.4, 7.3.0.1, and 8.0.3.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
The vulnerability under discussion represents a critical relative path traversal flaw within the Erlang OTP standard library's zip module, specifically affecting the stdlib component responsible for archive handling operations. This weakness exists in the zip:unzip/1,2 and zip:extract/1,2 functions that process compressed archives containing maliciously crafted file paths. The core issue stems from an inadequate validation mechanism implemented in the zip:check_dir_level/2 function which employs a simplistic integer counter approach to track directory traversal depth during path validation. The vulnerability occurs when processing zip archives that contain entries with path components designed to manipulate this counter through a sequence of ../ operations followed by normal path elements, creating a scenario where intermediate negative counter values are temporarily encountered but ultimately resolved to zero.
The technical execution of this vulnerability relies on the specific implementation pattern where the directory depth tracking counter is decremented for each ../ component and incremented for standard path components. When a path like ../x/y is processed, the counter initially decreases from zero to negative values during the ../ traversal phase, then increases back to zero as normal path components are encountered. This validation mechanism fails to account for the temporal state of the counter during processing, allowing paths that temporarily dip below zero to pass validation checks while ultimately resolving to locations outside the intended extraction directory. The flaw becomes apparent when the validated path is subsequently joined with the current working directory through the add_cwd function, resulting in file placement outside the designated target location. This particular vulnerability affects OTP versions from 27.1 through 27.3.4.15, 28.5.0.4, and 29.0.4, with corresponding stdlib releases from 6.1 through 6.2.2.4, 7.3.0.1, and 8.0.3, demonstrating the widespread impact across multiple major OTP release lines.
The operational impact of this vulnerability extends beyond simple file system manipulation to encompass potential security breaches involving arbitrary file creation and overwriting in unintended locations. Attackers can exploit this flaw to write malicious files to sensitive directories on the target system, potentially leading to privilege escalation or persistence mechanisms when combined with other vulnerabilities. The vulnerability directly maps to CWE-22 - Improper Limitation of a Pathname to a Restricted Directory, which classifies path traversal issues that allow attackers to access files outside of designated directories. From an adversary perspective, this weakness aligns with ATT&CK technique T1059.007 - Command and Scripting Interpreter: PowerShell, as it enables adversaries to establish persistence by creating malicious files in system directories or by placing backdoors in locations where legitimate processes might execute code. The vulnerability's exploitation potential increases significantly when the target application processes untrusted zip archives with elevated privileges, making it particularly dangerous in server-side applications or services that handle file uploads and decompression.
Mitigation strategies should prioritize immediate patching of affected OTP versions to the latest releases containing the fixed stdlib components. Organizations must also implement comprehensive input validation for all zip archive processing operations, including additional path sanitization beyond the existing counter-based validation. Security-conscious developers should consider implementing stricter path validation routines that track absolute path components rather than relying solely on relative depth counters, and should validate final resolved paths against intended extraction directories using canonical path resolution techniques. Network-level protections can include filtering zip file uploads at perimeter defenses and implementing application firewalls that monitor for suspicious path patterns in archive processing operations. Additionally, system administrators should conduct thorough audits of all applications utilizing OTP's zip functionality to identify potential attack vectors and ensure proper privilege separation when processing untrusted archive content, particularly in environments where zip extraction occurs with elevated privileges or in sensitive system directories.