Security readout for executives and security teams
Plain-English summary
Affected Erlang/OTP applications can allow a crafted ZIP archive to place or alter files outside the intended extraction directory. Exploitation requires the archive to be processed and affects integrity and availability rather than confidentiality. Business impact depends on which files the application can write.
Executive priority
Prioritize remediation for internet-facing, multi-tenant, or automated services that extract externally supplied ZIP files. Other deployments should be inventoried and scheduled for routine patching. Escalate if extraction runs with broad write privileges or can reach configuration, application, or shared files.
Technical view
CVE-2025-4748 is a CWE-22 absolute path traversal in OTP stdlib zip.erl. The affected zip:unzip and zip:extract routines insufficiently restrict extraction paths when writing to disk; calls using the memory option are excluded. CVSS 4.0 is 4.8, reflecting local access, low complexity, passive user interaction, and limited integrity and availability impact.
Likely exposure
Exposure is most likely where Erlang/OTP software uses zip:unzip or zip:extract to write attacker-influenced archives to disk. OTP releases from 17.0 below the listed fixed versions are affected. Workloads using only the memory option are excluded by the supplied description.
Exploitation context
The supplied sources do not establish active exploitation, and the CVE is not identified as KEV. Successful abuse requires an affected application to process a crafted archive without the memory option. Resulting file manipulation is constrained by the operating-system permissions of the extracting process.
Researcher notes
The affected program is lib/stdlib/src/zip.erl, covering zip:unzip/1, zip:unzip/2, zip:extract/1, and zip:extract/2 unless memory mode is used. Fixed boundaries are OTP 28.0.1, 27.3.4.1, and 26.2.5.13, corresponding to stdlib 7.0.1, 6.2.2.1, and 5.2.3.4. No public exploitation evidence is supplied.
Mitigation direction
- Upgrade to OTP 28.0.1, 27.3.4.1, 26.2.5.13, or a later applicable release.
- Where appropriate, use the documented memory option instead of extracting files directly to disk.
- Restrict archive ingestion to trusted sources until affected deployments are upgraded.
- Run extraction services with minimal filesystem permissions and isolated writable directories.
- Review the vendor advisory and patches before backporting changes to unsupported branches.
Validation and detection
- Inventory deployed OTP and stdlib versions, including bundled runtimes and containers.
- Search application code for zip:unzip and zip:extract calls.
- Determine whether affected calls write archives to disk or pass the memory option.
- Trace whether archive contents can originate from users, partners, downloads, or other untrusted sources.
- Confirm upgraded versions meet the applicable fixed-version boundary.
- Review extraction directories for unexpected file creation or modification.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-4748 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L——EEFVulnerability scoring details
Base CVSS 4.0 score
4.8MediumVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/erlang/otp/security/advisories/GHSA-9g37-pgj9-wrhcCVE reference, EEF · vendor-advisory, related
- https://cna.erlef.org/cves/CVE-2025-4748.htmlCVE reference, EEF · related
- https://osv.dev/vulnerability/EEF-CVE-2025-4748CVE reference, EEF · related
- https://www.erlang.org/doc/system/versions.html#order-of-versionsCVE reference, EEF · x_version-scheme
- https://github.com/erlang/otp/pull/9941CVE reference, EEF · patch
- https://github.com/erlang/otp/commit/5a55feec10c9b69189d56723d8f237afa58d5d4fCVE reference, EEF · patch
- https://github.com/erlang/otp/commit/ba2f2bc5f45fcfd2d6201ba07990a678bbf4cc8fCVE reference, EEF · patch
- https://github.com/erlang/otp/commit/578d4001575aa7647ea1efd4b2b7e3afadcc99a5CVE reference, EEF · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.