Relative Path Traversal in Erlang OTP's stdlib zip Module

CVE-2026-47078

What is CVE-2026-47078?

A vulnerability exists in the Erlang OTP's stdlib zip module that allows attackers to write files outside the intended extraction directory by exploiting crafted zip archives. The flawed validation logic in functions such as zip:unzip/1,2 and zip:extract/1,2 permits malicious paths that can navigate outside of the secure directory boundaries. This is achieved by manipulating the directory depth counter, which erroneously allows paths that result in negative values, thus bypassing security checks. As a result, the attacker can extract files to unintended locations, posing a significant security risk.

References