This vulnerability (CWE-22) in Erlang OTP's stdlib zip module allows improper limitation of pathnames, enabling absolute path traversal and potential unauthorized file manipulation. The affected functions are zip:unzip/1, zip:unzip/2, zip:extract/1, and zip:extract/2, which do not properly restrict extracted file paths unless the memory option is passed. The issue impacts OTP versions from 17.0 before 28.0.1, including OTP 27.3.4.1 and OTP 26.2.5.13, corresponding to stdlib versions from 2.0 before 7.0.1, 6.2.2.1, and 5.2.3.4. No patch links or vendor advisories are provided, and no known exploits are reported.

Exploitation of this vulnerability could allow an attacker to perform absolute path traversal during zip file extraction, potentially leading to unauthorized file manipulation on the affected system. The CVSS 4.8 score reflects a medium severity with local attack vector and low privileges required, but user interaction is needed. There is no indication of remote exploitation or privilege escalation beyond the local user context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted zip files with the vulnerable zip:unzip and zip:extract functions without the memory option. Monitor Erlang OTP vendor channels for updates and apply patches once released.