The vulnerability in Erlang OTP's stdlib zip module (lib/stdlib/src/zip.erl) involves the zip:unzip/1,2 and zip:extract/1,2 functions which validate zip entry paths using a directory depth counter in zip:check_dir_level/2. The counter increments for normal path components and decrements for '..'. The validation only rejects paths if the final counter is negative, allowing crafted paths like '../x/y' that temporarily decrement the counter below zero but end at zero to bypass checks. This results in files being extracted outside the intended directory, leading to a relative path traversal vulnerability (CWE-23). The affected versions include OTP 27.1 up to but not including 29.0.4, OTP 28.5.0.4, and OTP 27.3.4.15, with corresponding stdlib versions from 6.1 up to but not including 8.0.3, 7.3.0.1, and 6.2.2.4 respectively. No vendor advisory or patch information is currently available.

An attacker who can supply a crafted zip archive to the vulnerable functions can cause files to be written outside the intended extraction directory. This may lead to overwriting arbitrary files on the filesystem with the privileges of the process performing the extraction. The impact is limited by the local vector (AV:L) and requires user interaction (UI:P). The overall severity is medium with a CVSS score of 4.8.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid extracting untrusted zip archives using the vulnerable Erlang OTP stdlib zip module functions. Monitor Erlang OTP vendor channels for updates and apply official patches once released.