This vulnerability in Erlang OTP's stdlib zip module (lib/stdlib/src/zip.erl) involves improper limitation of pathnames to restricted directories (CWE-22). The affected functions zip:unzip/1, zip:unzip/2, zip:extract/1, and zip:extract/2 allow absolute path traversal and file manipulation unless the memory option is specified. It impacts OTP versions from 17.0 through 28.0.1 and corresponding stdlib versions. The CVSS 4.8 indicates a medium risk with local attack vector and low privileges required but user interaction needed.

An attacker with local access and ability to invoke vulnerable zip functions could perform absolute path traversal, potentially manipulating files outside intended directories. This could lead to unauthorized file access or modification. However, the impact is limited by the requirement for local access and user interaction, and no known exploits are reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the vulnerable zip:unzip and zip:extract functions without the memory option. Monitor Erlang OTP vendor communications for patches or updates addressing this vulnerability.