CVE-2026-47078
- Source
- https://cve.org/CVERecord?id=CVE-2026-47078
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47078.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-47078
- Aliases
-
- EEF-CVE-2026-47078
- GHSA-rf72-wp7h-jg3x
- Downstream
- Published
- 2026-07-27T15:03:50.929Z
- Modified
- 2026-07-31T11:45:42.756741235Z
- Severity
-
- 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L CVSS Calculator
- Summary
- Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass
- Details
-
Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive.
zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:checkdirlevel/2, which tracks directory depth as a running integer counter: .. decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as ../x/y causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via add_cwd.
This vulnerability is associated with program file lib/stdlib/src/zip.erl.
This issue affects OTP from OTP 27.1 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to stdlib from 6.1 before 8.0.3, 7.3.0.1 and 6.2.2.4.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47078.json", "cwe_ids": [ "CWE-23" ], "cna_assigner": "EEF", "unresolved_ranges": [ { "source": "AFFECTED_FIELD", "extracted_events": [ { "introduced": "6.1" }, { "fixed": "*" }, { "introduced": "27.1" }, { "fixed": "*" }, { "introduced": "8d537f51a4262d24f3395c4148323eaca9facbbd" }, { "fixed": "8a933c9c7835b06776d31d17b79b7336627d887a" } ] } ] }- References
-
- https://cna.erlef.org/cves/CVE-2026-47078.html
- https://github.com
- https://osv.dev/vulnerability/EEF-CVE-2026-47078
- https://www.erlang.org/doc/system/versions.html#order-of-versions
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47078.json
- https://github.com/erlang/otp/security/advisories/GHSA-rf72-wp7h-jg3x
- https://nvd.nist.gov/vuln/detail/CVE-2026-47078
- https://github.com/erlang/otp/commit/8a933c9c7835b06776d31d17b79b7336627d887a
- https://github.com/erlang/otp
Affected packages
Git / github.com/erlang/otp
Affected ranges
- Type
- GIT
- Repo
- https://github.com/erlang/otp
- Events
-
IntroducedIntroducedIntroducedFixedFixedFixedFixed
- Database specific
{ "source": [ "CPE_FIELD", "REFERENCES" ], "extracted_events": [ { "introduced": "27.1" }, { "fixed": "27.3.4.15" }, { "introduced": "28.0" }, { "fixed": "28.5.0.4" }, { "introduced": "29.0" }, { "fixed": "29.0.4" } ] }