Executive brief
Erlang OTP is a popular development platform used to build scalable and high-availability systems. A security flaw in its built-in ZIP file handling module allows a specially crafted archive to write files to locations on the server outside of the intended folder. If an application uses this module to extract uploaded files, an attacker could potentially overwrite critical system files or configuration, leading to system instability or unauthorized access.
Technical details
A path traversal vulnerability exists in the Erlang OTP 'zip' module (specifically zip:unzip/1,2 and zip:extract/1,2). The root cause is an insufficient validation logic in zip:check_dir_level/2, which uses a running integer counter to track directory depth. While it decrements for '..' and increments for normal components, it only rejects paths if the final counter value is negative. An attacker can provide a path like '../x/y' which temporarily dips below zero but returns to zero at the end, bypassing the check. When combined with the current working directory, this allows file writes to unauthorized parent directories. Patches are available in OTP versions 27.3.4.15, 28.5.0.4, and 29.0.4.
Affected products
- Erlang OTP 27.1 to 27.3.4.14, 28.0 to 28.5.0.3, 29.0 to 29.0.3
- Erlang stdlib 6.1 to 6.2.2.3, 7.0 to 7.3.0.0, 8.0 to 8.0.2
Timeline
- 2026-07-27: advisory
- 2026-07-27: disclosed