https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 20:55:27 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-103061 <p>Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;) vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project&#39;s build directory when a developer builds a project.</p> <p>A Hex package release&#39;s metadata carries an app field with the release&#39;s OTP application name. Gleam reads this field from the hex.pm release API when it downloads dependencies and uses it as the package&#39;s build directory name without validating it (hex_manifest_package in compiler-cli/src/dependencies.rs, ProjectPaths::build_directory_for_package). When a dependency fails to compile, Gleam deletes that directory with remove_dir_all. hex.pm didn&#39;t restrict the field to a directory name before 2026-10-12, so a publisher could set it to a value such as ../../../../target or an absolute path. When a project depends on such a release directly or transitively and the release fails to compile, gleam build, gleam check, gleam run, gleam test or gleam export deletes the directory the name resolves to. For a pure Gleam package no publisher code runs.</p> <p>This issue affects gleam: from 0.32.4 before 1.19.2.</p> <p>Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;) vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project&#39;s build directory when a developer builds a project.</p> <p>A Hex package release&#39;s metadata carries an app field with the release&#39;s OTP application name. Gleam reads this field from the hex.pm release API when it downloads dependencies and uses it as the package&#39;s build directory name without validating it (hex_manifest_package in compiler-cli/src/dependencies.rs, ProjectPaths::build_directory_for_package). When a dependency fails to compile, Gleam deletes that directory with remove_dir_all. hex.pm didn&#39;t restrict the field to a directory name before 2026-10-12, so a publisher could set it to a value such as ../../../../target or an absolute path. When a project depends on such a release directly or transitively and the release fails to compile, gleam build, gleam check, gleam run, gleam test or gleam export deletes the directory the name resolves to. For a pure Gleam package no publisher code runs.</p> <p>This issue affects gleam: from 0.32.4 before 1.19.2.</p> https://db.gcve.eu/vuln/fkie_cve-2026-103061