BSD PortsErlang - Absolute Path in Zip Module
https://github.com/erlang/otp/security/advisories/GHSA-9g37-pgj9-wrhc reports: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2unless the …
Affected versions
- erlang >= 17.0 < 26.2.5.13,4
- erlang-runtime26 < 26.2.5.13
- erlang-runtime27 < 27.3.4.1
- erlang-runtime28 < 28.0.1
By system
4 still vulnerable, 3 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | lang/erlang | 25.3.2.7_1,4 | vulnerable since 2025-10-29 | |
| NetBSD | lang/erlang | 27.3.4.7 | not listed | |
| MidnightBSD | lang/erlang | 25.3.2.20_1,4 | in range, by version | |
| FreeBSD | lang/erlang | 28.5.0.8_1,4 | fixed | (272 days after) |
| DragonFly | lang/erlang-runtime26 | 26.2.5.12 | vulnerable since 2025-10-29 | |
| MidnightBSD | lang/erlang-runtime26 | 26.2.5_2 | in range, by version | |
| DragonFly | lang/erlang-runtime27 | 27.3.4 | vulnerable since 2025-10-29 | |
| FreeBSD | lang/erlang-runtime27 | 27.3.4.19_1 | fixed | (272 days after) |
| DragonFly | lang/erlang-runtime28 | 28.0 | vulnerable since 2025-10-29 | |
| MidnightBSD | lang/erlang-runtime28 | 28.5.0.8 | out of range, by version | |
| FreeBSD | lang/erlang-runtime28 | 28.5.0.8_1 | fixed | (272 days after) |