CVE-2025-4748

Vulnerability

CVE-2025-4748 is an absolute path traversal vulnerability in Erlang/OTP's stdlib zip module, specifically in the routines zip:unzip/1, zip:unzip/2, zip:extract/1, and zip:extract/2 (unless the memory option is used) [1]. The root cause lies in the insufficient sanitization of filenames within archive entries; the code does not strip leading path separators or .. sequences, allowing entries with absolute paths (e.g., /tmp/evil) to be processed [2][3]. This is classified as CWE-22 (Path Traversal) and CAPEC-597 (Absolute Path Traversal) [2].

Exploitation

To exploit this vulnerability, an attacker must craft a malicious ZIP archive containing entries with absolute filenames and convince a user or automated process to extract it using the affected functions without the memory option [1]. No authentication is required, but the attack is local (requires the victim to extract the archive) and has low complexity [3]. The functions trust the archive's metadata, and the bug has existed since OTP 17.0 through the affected versions (OTP 17.0 to 28.0.1, 27.3.4.1, and 26.2.5.13) [1][2]. Code commits show that patched versions introduce a sanitize_filenames/1 test and adjust extraction logic to reject or relativize absolute paths [3][4].

Impact

Successful exploitation allows file manipulation at the attacker's chosen absolute path on the filesystem, enabling arbitrary file writes or overwrites. This could lead to data corruption, denial of service, or potential privilege escalation if critical system files (e.g., configuration, libraries) are overwritten. The CVSS 4.0 base score is 4.8 (Medium) with impacts on integrity and availability (VI:L, VA:L) but no confidentiality impact [2].

Mitigation

The vulnerability is patched in OTP releases 28.0.1, 27.3.4.1, and 26.2.5.13 [1]. Users are strongly advised to upgrade to these fixed versions or any later release. As a general workaround, using the memory option (zip:extract(..., [memory])) avoids file system writes entirely, mitigating the traversal risk [1].