CVE-2025-4748 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2025-4748 Interim 1 6 2026-03-05T01:31:48Z current 2025-06-16T23:20:47Z 2026-03-05T01:31:48Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2025-4748 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2 unless the memory option is passed. This issue affects OTP from OTP 17.0 until OTP 28.0.1, OTP 27.3.4.1 and OTP 26.2.5.13, corresponding to stdlib from 2.0 until 7.0.1, 6.2.2.1 and 5.2.3.4. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2025-July/021836.html E-Mail link for SUSE-SU-2025:02331-1 https://lists.suse.com/pipermail/sle-security-updates/2025-July/021835.html E-Mail link for SUSE-SU-2025:02332-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SLES-LTSS-TERADATA 15 SP2 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS SUSE Linux Enterprise Module for Server Applications 15 SP6 SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Server 15 SP4-TERADATA SUSE Linux Enterprise Server 15 SP5-LTSS SUSE Linux Enterprise Module for Server Applications 15 SP6 SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP5 SUSE Linux Enterprise Module for Server Applications 15 SP6 SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise Server for SAP applications 16.0 SUSE Manager Proxy 4.3 SUSE Manager Proxy LTS 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Retail Branch Server LTS 4.3 SUSE Manager Server 4.3 SUSE Manager Server LTS 4.3 openSUSE Leap 15.6 erlang erlang-23.3.4.19-150300.3.23.3 erlang-debugger-23.3.4.19-150300.3.23.3 erlang-debugger-src-23.3.4.19-150300.3.23.3 erlang-dialyzer-23.3.4.19-150300.3.23.3 erlang-dialyzer-src-23.3.4.19-150300.3.23.3 erlang-diameter-23.3.4.19-150300.3.23.3 erlang-diameter-src-23.3.4.19-150300.3.23.3 erlang-doc-23.3.4.19-150300.3.23.3 erlang-epmd erlang-epmd-23.3.4.19-150300.3.23.3 erlang-et-23.3.4.19-150300.3.23.3 erlang-et-src-23.3.4.19-150300.3.23.3 erlang-jinterface-23.3.4.19-150300.3.23.3 erlang-jinterface-src-23.3.4.19-150300.3.23.3 erlang-observer-23.3.4.19-150300.3.23.3 erlang-observer-src-23.3.4.19-150300.3.23.3 erlang-reltool-23.3.4.19-150300.3.23.3 erlang-reltool-src-23.3.4.19-150300.3.23.3 erlang-src-23.3.4.19-150300.3.23.3 erlang-wx-23.3.4.19-150300.3.23.3 erlang-wx-src-23.3.4.19-150300.3.23.3 erlang26-26.2.1-150300.7.14.3 erlang26-debugger-26.2.1-150300.7.14.3 erlang26-debugger-src-26.2.1-150300.7.14.3 erlang26-dialyzer-26.2.1-150300.7.14.3 erlang26-dialyzer-src-26.2.1-150300.7.14.3 erlang26-diameter-26.2.1-150300.7.14.3 erlang26-diameter-src-26.2.1-150300.7.14.3 erlang26-doc-26.2.1-150300.7.14.3 erlang26-epmd-26.2.1-150300.7.14.3 erlang26-et-26.2.1-150300.7.14.3 erlang26-et-src-26.2.1-150300.7.14.3 erlang26-jinterface-26.2.1-150300.7.14.3 erlang26-jinterface-src-26.2.1-150300.7.14.3 erlang26-observer-26.2.1-150300.7.14.3 erlang26-observer-src-26.2.1-150300.7.14.3 erlang26-reltool-26.2.1-150300.7.14.3 erlang26-reltool-src-26.2.1-150300.7.14.3 erlang26-src-26.2.1-150300.7.14.3 erlang26-wx-26.2.1-150300.7.14.3 erlang26-wx-src-26.2.1-150300.7.14.3 erlang-23.3.4.19-150300.3.23.3 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP6 erlang-epmd-23.3.4.19-150300.3.23.3 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP6 erlang26-26.2.1-150300.7.14.3 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP6 erlang26-epmd-26.2.1-150300.7.14.3 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP6 erlang-23.3.4.19-150300.3.23.3 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 erlang-epmd-23.3.4.19-150300.3.23.3 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 erlang26-26.2.1-150300.7.14.3 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 erlang26-epmd-26.2.1-150300.7.14.3 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 erlang-23.3.4.19-150300.3.23.3 as a component of SUSE Linux Enterprise Server 15 SP4-TERADATA erlang-epmd-23.3.4.19-150300.3.23.3 as a component of SUSE Linux Enterprise Server 15 SP4-TERADATA erlang-23.3.4.19-150300.3.23.3 as a component of openSUSE Leap 15.6 erlang-debugger-23.3.4.19-150300.3.23.3 as a component of openSUSE Leap 15.6 erlang-debugger-src-23.3.4.19-150300.3.23.3 as a component of openSUSE Leap 15.6 erlang-dialyzer-23.3.4.19-150300.3.23.3 as a component of openSUSE Leap 15.6 erlang-dialyzer-src-23.3.4.19-150300.3.23.3 as a component of openSUSE Leap 15.6 erlang-diameter-23.3.4.19-150300.3.23.3 as a component of openSUSE Leap 15.6 erlang-diameter-src-23.3.4.19-150300.3.23.3 as a component of openSUSE Leap 15.6 erlang-doc-23.3.4.19-150300.3.23.3 as a component of openSUSE Leap 15.6 erlang-epmd-23.3.4.19-150300.3.23.3 as a component of openSUSE Leap 15.6 erlang-et-23.3.4.19-150300.3.23.3 as a component of openSUSE Leap 15.6 erlang-et-src-23.3.4.19-150300.3.23.3 as a component of openSUSE Leap 15.6 erlang-jinterface-23.3.4.19-150300.3.23.3 as a component of openSUSE Leap 15.6 erlang-jinterface-src-23.3.4.19-150300.3.23.3 as a component of openSUSE Leap 15.6 erlang-observer-23.3.4.19-150300.3.23.3 as a component of openSUSE Leap 15.6 erlang-observer-src-23.3.4.19-150300.3.23.3 as a component of openSUSE Leap 15.6 erlang-reltool-23.3.4.19-150300.3.23.3 as a component of openSUSE Leap 15.6 erlang-reltool-src-23.3.4.19-150300.3.23.3 as a component of openSUSE Leap 15.6 erlang-src-23.3.4.19-150300.3.23.3 as a component of openSUSE Leap 15.6 erlang-wx-23.3.4.19-150300.3.23.3 as a component of openSUSE Leap 15.6 erlang-wx-src-23.3.4.19-150300.3.23.3 as a component of openSUSE Leap 15.6 erlang26-26.2.1-150300.7.14.3 as a component of openSUSE Leap 15.6 erlang26-debugger-26.2.1-150300.7.14.3 as a component of openSUSE Leap 15.6 erlang26-debugger-src-26.2.1-150300.7.14.3 as a component of openSUSE Leap 15.6 erlang26-dialyzer-26.2.1-150300.7.14.3 as a component of openSUSE Leap 15.6 erlang26-dialyzer-src-26.2.1-150300.7.14.3 as a component of openSUSE Leap 15.6 erlang26-diameter-26.2.1-150300.7.14.3 as a component of openSUSE Leap 15.6 erlang26-diameter-src-26.2.1-150300.7.14.3 as a component of openSUSE Leap 15.6 erlang26-doc-26.2.1-150300.7.14.3 as a component of openSUSE Leap 15.6 erlang26-epmd-26.2.1-150300.7.14.3 as a component of openSUSE Leap 15.6 erlang26-et-26.2.1-150300.7.14.3 as a component of openSUSE Leap 15.6 erlang26-et-src-26.2.1-150300.7.14.3 as a component of openSUSE Leap 15.6 erlang26-jinterface-26.2.1-150300.7.14.3 as a component of openSUSE Leap 15.6 erlang26-jinterface-src-26.2.1-150300.7.14.3 as a component of openSUSE Leap 15.6 erlang26-observer-26.2.1-150300.7.14.3 as a component of openSUSE Leap 15.6 erlang26-observer-src-26.2.1-150300.7.14.3 as a component of openSUSE Leap 15.6 erlang26-reltool-26.2.1-150300.7.14.3 as a component of openSUSE Leap 15.6 erlang26-reltool-src-26.2.1-150300.7.14.3 as a component of openSUSE Leap 15.6 erlang26-src-26.2.1-150300.7.14.3 as a component of openSUSE Leap 15.6 erlang26-wx-26.2.1-150300.7.14.3 as a component of openSUSE Leap 15.6 erlang26-wx-src-26.2.1-150300.7.14.3 as a component of openSUSE Leap 15.6 erlang as a component of SLES-LTSS-TERADATA 15 SP2 erlang as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS erlang-epmd as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS erlang as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS erlang-epmd as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS erlang as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS erlang-epmd as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS erlang as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS erlang-epmd as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS erlang as a component of SUSE Linux Enterprise Server 15 SP2-LTSS erlang-epmd as a component of SUSE Linux Enterprise Server 15 SP2-LTSS erlang as a component of SUSE Linux Enterprise Server 15 SP3-LTSS erlang-epmd as a component of SUSE Linux Enterprise Server 15 SP3-LTSS erlang as a component of SUSE Linux Enterprise Server 15 SP4-LTSS erlang-epmd as a component of SUSE Linux Enterprise Server 15 SP4-LTSS erlang as a component of SUSE Linux Enterprise Server 15 SP5-LTSS erlang-epmd as a component of SUSE Linux Enterprise Server 15 SP5-LTSS erlang as a component of SUSE Linux Enterprise Server 16.0 erlang-epmd as a component of SUSE Linux Enterprise Server 16.0 erlang as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 erlang-epmd as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 erlang as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 erlang-epmd as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 erlang as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 erlang-epmd as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 erlang as a component of SUSE Linux Enterprise Server for SAP applications 16.0 erlang-epmd as a component of SUSE Linux Enterprise Server for SAP applications 16.0 erlang as a component of SUSE Manager Proxy 4.3 erlang-epmd as a component of SUSE Manager Proxy 4.3 erlang as a component of SUSE Manager Proxy LTS 4.3 erlang-epmd as a component of SUSE Manager Proxy LTS 4.3 erlang as a component of SUSE Manager Retail Branch Server 4.3 erlang-epmd as a component of SUSE Manager Retail Branch Server 4.3 erlang as a component of SUSE Manager Retail Branch Server LTS 4.3 erlang-epmd as a component of SUSE Manager Retail Branch Server LTS 4.3 erlang as a component of SUSE Manager Server 4.3 erlang-epmd as a component of SUSE Manager Server 4.3 erlang as a component of SUSE Manager Server LTS 4.3 erlang-epmd as a component of SUSE Manager Server LTS 4.3 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2 unless the memory option is passed. This issue affects OTP from OTP 17.0 until OTP 28.0.1, OTP 27.3.4.1 and OTP 26.2.5.13, corresponding to stdlib from 2.0 until 7.0.1, 6.2.2.1 and 5.2.3.4. CVE-2025-4748 SUSE Linux Enterprise Module for Server Applications 15 SP6:erlang-23.3.4.19-150300.3.23.3 SUSE Linux Enterprise Module for Server Applications 15 SP6:erlang-epmd-23.3.4.19-150300.3.23.3 SUSE Linux Enterprise Module for Server Applications 15 SP6:erlang26-26.2.1-150300.7.14.3 SUSE Linux Enterprise Module for Server Applications 15 SP6:erlang26-epmd-26.2.1-150300.7.14.3 SUSE Linux Enterprise Module for Server Applications 15 SP7:erlang-23.3.4.19-150300.3.23.3 SUSE Linux Enterprise Module for Server Applications 15 SP7:erlang-epmd-23.3.4.19-150300.3.23.3 SUSE Linux Enterprise Module for Server Applications 15 SP7:erlang26-26.2.1-150300.7.14.3 SUSE Linux Enterprise Module for Server Applications 15 SP7:erlang26-epmd-26.2.1-150300.7.14.3 SUSE Linux Enterprise Server 15 SP4-TERADATA:erlang-23.3.4.19-150300.3.23.3 SUSE Linux Enterprise Server 15 SP4-TERADATA:erlang-epmd-23.3.4.19-150300.3.23.3 openSUSE Leap 15.6:erlang-23.3.4.19-150300.3.23.3 openSUSE Leap 15.6:erlang-debugger-23.3.4.19-150300.3.23.3 openSUSE Leap 15.6:erlang-debugger-src-23.3.4.19-150300.3.23.3 openSUSE Leap 15.6:erlang-dialyzer-23.3.4.19-150300.3.23.3 openSUSE Leap 15.6:erlang-dialyzer-src-23.3.4.19-150300.3.23.3 openSUSE Leap 15.6:erlang-diameter-23.3.4.19-150300.3.23.3 openSUSE Leap 15.6:erlang-diameter-src-23.3.4.19-150300.3.23.3 openSUSE Leap 15.6:erlang-doc-23.3.4.19-150300.3.23.3 openSUSE Leap 15.6:erlang-epmd-23.3.4.19-150300.3.23.3 openSUSE Leap 15.6:erlang-et-23.3.4.19-150300.3.23.3 openSUSE Leap 15.6:erlang-et-src-23.3.4.19-150300.3.23.3 openSUSE Leap 15.6:erlang-jinterface-23.3.4.19-150300.3.23.3 openSUSE Leap 15.6:erlang-jinterface-src-23.3.4.19-150300.3.23.3 openSUSE Leap 15.6:erlang-observer-23.3.4.19-150300.3.23.3 openSUSE Leap 15.6:erlang-observer-src-23.3.4.19-150300.3.23.3 openSUSE Leap 15.6:erlang-reltool-23.3.4.19-150300.3.23.3 openSUSE Leap 15.6:erlang-reltool-src-23.3.4.19-150300.3.23.3 openSUSE Leap 15.6:erlang-src-23.3.4.19-150300.3.23.3 openSUSE Leap 15.6:erlang-wx-23.3.4.19-150300.3.23.3 openSUSE Leap 15.6:erlang-wx-src-23.3.4.19-150300.3.23.3 openSUSE Leap 15.6:erlang26-26.2.1-150300.7.14.3 openSUSE Leap 15.6:erlang26-debugger-26.2.1-150300.7.14.3 openSUSE Leap 15.6:erlang26-debugger-src-26.2.1-150300.7.14.3 openSUSE Leap 15.6:erlang26-dialyzer-26.2.1-150300.7.14.3 openSUSE Leap 15.6:erlang26-dialyzer-src-26.2.1-150300.7.14.3 openSUSE Leap 15.6:erlang26-diameter-26.2.1-150300.7.14.3 openSUSE Leap 15.6:erlang26-diameter-src-26.2.1-150300.7.14.3 openSUSE Leap 15.6:erlang26-doc-26.2.1-150300.7.14.3 openSUSE Leap 15.6:erlang26-epmd-26.2.1-150300.7.14.3 openSUSE Leap 15.6:erlang26-et-26.2.1-150300.7.14.3 openSUSE Leap 15.6:erlang26-et-src-26.2.1-150300.7.14.3 openSUSE Leap 15.6:erlang26-jinterface-26.2.1-150300.7.14.3 openSUSE Leap 15.6:erlang26-jinterface-src-26.2.1-150300.7.14.3 openSUSE Leap 15.6:erlang26-observer-26.2.1-150300.7.14.3 openSUSE Leap 15.6:erlang26-observer-src-26.2.1-150300.7.14.3 openSUSE Leap 15.6:erlang26-reltool-26.2.1-150300.7.14.3 openSUSE Leap 15.6:erlang26-reltool-src-26.2.1-150300.7.14.3 openSUSE Leap 15.6:erlang26-src-26.2.1-150300.7.14.3 openSUSE Leap 15.6:erlang26-wx-26.2.1-150300.7.14.3 openSUSE Leap 15.6:erlang26-wx-src-26.2.1-150300.7.14.3 moderate 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L