https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 14:43:38 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-96612 <p>Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;) vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project&#39;s deps directory and extract package files into it when a developer fetches dependencies.</p> <p>A package release&#39;s requirements carry an app label that names the dependency&#39;s OTP application. Hex takes this label from the repository&#39;s signed registry and uses it as the dependency&#39;s application name without validating it (Hex.RemoteConverger.deps/2, Hex.Mix.to_lock/1). Mix derives the dependency&#39;s checkout directory as deps/&lt;app&gt;, and Hex.SCM.update/1 runs File.rm_rf!/1 on that directory and unpacks the package into it. hex.pm only checks the label&#39;s length, so a publisher can set it to a value such as ../../target. When a project depends on such a release directly or transitively, mix deps.get or mix deps.update deletes the directory the label resolves to and writes the labelled package&#39;s files there. This happens before any dependency code is compiled.</p> <p>This issue affects hex: from 0.6.0 before 2.5.2.</p> <p>Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;) vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project&#39;s deps directory and extract package files into it when a developer fetches dependencies.</p> <p>A package release&#39;s requirements carry an app label that names the dependency&#39;s OTP application. Hex takes this label from the repository&#39;s signed registry and uses it as the dependency&#39;s application name without validating it (Hex.RemoteConverger.deps/2, Hex.Mix.to_lock/1). Mix derives the dependency&#39;s checkout directory as deps/&lt;app&gt;, and Hex.SCM.update/1 runs File.rm_rf!/1 on that directory and unpacks the package into it. hex.pm only checks the label&#39;s length, so a publisher can set it to a value such as ../../target. When a project depends on such a release directly or transitively, mix deps.get or mix deps.update deletes the directory the label resolves to and writes the labelled package&#39;s files there. This happens before any dependency code is compiled.</p> <p>This issue affects hex: from 0.6.0 before 2.5.2.</p> https://db.gcve.eu/vuln/fkie_cve-2026-96612