Path traversal in otp - CVE-2025-4748

Vulnerability identifier: #VU111243

CSH Severity: High

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-4748

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to write arbitrary files to the system.

The vulnerability exists due to improper validation of .zip archives in the Erlang/OTP standard-library ZIP routines "zip:unzip/1,2" and "zip:extract/1,2". A remote attacker can pass a specially crafted .zip archive to the application and write files to arbitrary locations on the system. 

otp
Arch Linux
openEuler
Ubuntu
Anolis OS
Tenable Identity Exposure (formerly Tenable.ad)
erlang (Ubuntu package)
erlang-megaco
erlang
erlang-mnesia
erlang-observer
erlang-odbc
erlang-os_mon
erlang-parsetools
erlang-public_key
erlang-reltool
erlang-runtime_tools
erlang-sasl
erlang-snmp
erlang-src
erlang-ssh
erlang-ssl
erlang-stdlib
erlang-syntax_tools
erlang-tftp
erlang-tools
erlang-wx
erlang-xmerl
erlang-edoc
erlang-kernel
erlang-asn1
erlang-common_test
erlang-compiler
erlang-crypto
erlang-debugger
erlang-debuginfo
erlang-debugsource
erlang-dialyzer
erlang-diameter
erlang-eldap
erlang-erl_docgen
erlang-erl_interface
erlang-erts
erlang-et
erlang-eunit
erlang-examples
erlang-ftp
erlang-inets
erlang-jinterface

Install updates from vendor's website.

otp - addressed in versions 26.2.5.13, 27.3.4.1, 28.0.1
Tenable Identity Exposure (formerly Tenable.ad) - update to 3.77.12
erlang (Ubuntu package) - addressed in versions 1:24.2.1+dfsg-1ubuntu0.5, 1:25.3.2.8+dfsg-1ubuntu4.4, 1:27.3+dfsg-1ubuntu1.2
erlang-megaco - update to 25.3.2.6-8
erlang - update to 25.3.2.6-8
erlang-mnesia - update to 25.3.2.6-8
erlang-observer - update to 25.3.2.6-8
erlang-odbc - update to 25.3.2.6-8
erlang-os_mon - update to 25.3.2.6-8
erlang-parsetools - update to 25.3.2.6-8
erlang-public_key - update to 25.3.2.6-8
erlang-reltool - update to 25.3.2.6-8
erlang-runtime_tools - update to 25.3.2.6-8
erlang-sasl - update to 25.3.2.6-8
erlang-snmp - update to 25.3.2.6-8
erlang-src - update to 25.3.2.6-8
erlang-ssh - update to 25.3.2.6-8
erlang-ssl - update to 25.3.2.6-8
erlang-stdlib - update to 25.3.2.6-8
erlang-syntax_tools - update to 25.3.2.6-8
erlang-tftp - update to 25.3.2.6-8
erlang-tools - update to 25.3.2.6-8
erlang-wx - update to 25.3.2.6-8
erlang-xmerl - update to 25.3.2.6-8
erlang-edoc - update to 25.3.2.6-8
erlang-kernel - update to 25.3.2.6-8
erlang-asn1 - update to 25.3.2.6-8
erlang-common_test - update to 25.3.2.6-8
erlang-compiler - update to 25.3.2.6-8
erlang-crypto - update to 25.3.2.6-8
erlang-debugger - update to 25.3.2.6-8
erlang-debuginfo - update to 25.3.2.6-8
erlang-debugsource - update to 25.3.2.6-8
erlang-dialyzer - update to 25.3.2.6-8
erlang-diameter - update to 25.3.2.6-8
erlang-eldap - update to 25.3.2.6-8
erlang-erl_docgen - update to 25.3.2.6-8
erlang-erl_interface - update to 25.3.2.6-8
erlang-erts - update to 25.3.2.6-8
erlang-et - update to 25.3.2.6-8
erlang-eunit - update to 25.3.2.6-8
erlang-examples - update to 25.3.2.6-8
erlang-ftp - update to 25.3.2.6-8
erlang-inets - update to 25.3.2.6-8
erlang-jinterface - update to 25.3.2.6-8
erlang-dialyzer - update to 26.2.5.11-2
erlang-sasl - update to 26.2.5.11-2
erlang-erl_docgen - update to 26.2.5.11-2
erlang-kernel - update to 26.2.5.11-2
erlang-ssl - update to 26.2.5.11-2
erlang-inets - update to 26.2.5.11-2
erlang - update to 26.2.5.11-2
erlang-jinterface - update to 26.2.5.11-2
erlang-examples - update to 26.2.5.11-2
erlang-eunit - update to 26.2.5.11-2
erlang-erts - update to 26.2.5.11-2
erlang-runtime_tools - update to 26.2.5.11-2
erlang-tftp - update to 26.2.5.11-2
erlang-syntax_tools - update to 26.2.5.11-2
erlang-wx - update to 26.2.5.11-2
erlang-megaco - update to 26.2.5.11-2
erlang-asn1 - update to 26.2.5.11-2
erlang-snmp - update to 26.2.5.11-2
erlang-stdlib - update to 26.2.5.11-2
erlang-compiler - update to 26.2.5.11-2
erlang-common_test - update to 26.2.5.11-2
erlang-eldap - update to 26.2.5.11-2
erlang-crypto - update to 26.2.5.11-2
erlang-tools - update to 26.2.5.11-2
erlang-src - update to 26.2.5.11-2
erlang-erl_interface - update to 26.2.5.11-2
erlang-parsetools - update to 26.2.5.11-2
erlang-et - update to 26.2.5.11-2
erlang-odbc - update to 26.2.5.11-2
erlang-xmerl - update to 26.2.5.11-2
erlang-public_key - update to 26.2.5.11-2
erlang-ssh - update to 26.2.5.11-2
erlang-os_mon - update to 26.2.5.11-2
erlang-ftp - update to 26.2.5.11-2
erlang-edoc - update to 26.2.5.11-2
erlang-reltool - update to 26.2.5.11-2
erlang-diameter - update to 26.2.5.11-2
erlang-observer - update to 26.2.5.11-2
erlang-mnesia - update to 26.2.5.11-2
erlang - update to 28.0.1-1

• http://www.openwall.com/lists/oss-security/2025/06/16/5
• https://github.com/erlang/otp/pull/9941
• https://github.com/erlang/otp/security/advisories/GHSA-9g37-pgj9-wrhc

• Absolute path traversal in Erlang/OTP
• Arch Linux update for erlang
• openEuler update for erlang
• Ubuntu update for erlang
• Multiple vulnerabilities in Tenable Identity Exposure
• Anolis OS update for erlang