CVE-2026-47078 Erlang CVE debrief

Who should care

Users of Erlang OTP, particularly those using versions from OTP 27.1 before OTP 29.0.4, OTP 28.5.0.4, and OTP 27.3.4.15, should be aware of this vulnerability and take necessary actions to protect their systems. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) occurs because the zip:unzip/1,2 and zip:extract/1,2 functions validate entry paths using zip:check_dir_level/2, which tracks directory depth as a running integer counter. A crafted zip archive can cause the counter to go negative mid-traversal and then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via add_cwd. The vulnerability affects OTP from OTP 27.1 before OTP 29.0.4, OTP 28.5.0.4, and OTP 27.3.4.15.

Defensive priority

Medium

Recommended defensive actions

• Update Erlang OTP to a version that fixes the vulnerability (OTP 29.0.4, OTP 28.5.0.4, or OTP 27.3.4.15)
• Restrict access to the Erlang OTP zip module to trusted users
• Monitor for suspicious activity related to zip file extraction
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-27T16:17:07.643Z and was last modified on 2026-07-27T19:17:15.917Z. The NVD entry is currently Received. The vulnerability affects OTP from OTP 27.1 before OTP 29.0.4, OTP 28.5.0.4, and OTP 27.3.4.15, corresponding to stdlib from 6.1 before 8.0.3, 7.3.0.1 and 6.2.2.4. There is limited information available about the specific details of the vulnerability, and further verification is needed to understand the full scope of the issue.

Official resources