Erlang/OTP -- relative path traversal in the zip module

2026-07-27 · CVE-2026-47078 · VuXML entry

The Erlang/OTP team reports: Fixed a bug where zip:unzip/1,2 and zip:extract/1,2 were vulnerable to a relative path traversal attack. A crafted zip archive containing entry names such as ../x/y could have caused files to be written outside the intended extraction directory.

Affected versions

• erlang < 28.5.0.4,4
• erlang-runtime27 < 27.3.4.15
• erlang-runtime28 < 28.5.0.4
• erlang-runtime29 < 29.0.4

By system

3 still vulnerable, 4 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.