FKIE_CVE-2026-103061

Vulnerability from fkie_nvd - Published: 2026-10-12 19:16 - Updated: 2026-10-13 14:31
Severity
5.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project's build directory when a developer builds a project. A Hex package release's metadata carries an app field with the release's OTP application name. Gleam reads this field from the hex.pm release API when it downloads dependencies and uses it as the package's build directory name without validating it (hex_manifest_package in compiler-cli/src/dependencies.rs, ProjectPaths::build_directory_for_package). When a dependency fails to compile, Gleam deletes that directory with remove_dir_all. hex.pm didn't restrict the field to a directory name before 2026-10-12, so a publisher could set it to a value such as ../../../../target or an absolute path. When a project depends on such a release directly or transitively and the release fails to compile, gleam build, gleam check, gleam run, gleam test or gleam export deletes the directory the name resolves to. For a pure Gleam package no publisher code runs. This issue affects gleam: from 0.32.4 before 1.19.2.
References
6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://cna.erlef.org/cves/CVE-2026-103061.html
6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://github.com/gleam-lang/gleam/commit/54bbb2b98af1505b6eed93c45b1936fc76412e5c
6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://github.com/gleam-lang/gleam/commit/d13f27ee80aae7a521d2e9433c4deaf53f892574
6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://github.com/gleam-lang/gleam/commit/d15c981fac6e533d70ac8ee89a6ef4dbf139adc3
6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://github.com/gleam-lang/gleam/security/advisories/GHSA-jhcr-c7qm-8589
6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://osv.dev/vulnerability/EEF-CVE-2026-103061
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "gleam_cli::dependencies",
            "gleam_core::manifest",
            "gleam_core::paths",
            "gleam_core::build::project_compiler",
            "gleam_cli::fs"
          ],
          "packageName": "gleam",
          "packageURL": "pkg:software-id/gleam.run/gleam",
          "product": "Gleam",
          "programFiles": [
            "compiler-cli/src/dependencies.rs",
            "compiler-core/src/manifest.rs",
            "compiler-core/src/paths.rs",
            "compiler-core/src/build/project_compiler.rs",
            "compiler-cli/src/fs.rs"
          ],
          "programRoutines": [
            {
              "name": "gleam_cli::dependencies::hex_manifest_package"
            },
            {
              "name": "gleam_core::manifest::ManifestPackage::application_name"
            },
            {
              "name": "gleam_core::paths::ProjectPaths::build_directory_for_package"
            },
            {
              "name": "gleam_core::build::project_compiler::ProjectCompiler::load_cache_or_compile_package"
            },
            {
              "name": "gleam_cli::fs::delete_directory"
            }
          ],
          "vendor": "Gleam",
          "versions": [
            {
              "lessThan": "1.19.2",
              "status": "affected",
              "version": "0.32.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://ghcr.io",
          "cpes": [
            "cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "gleam_cli::dependencies",
            "gleam_core::manifest",
            "gleam_core::paths",
            "gleam_core::build::project_compiler",
            "gleam_cli::fs"
          ],
          "packageName": "gleam-lang/gleam",
          "packageURL": "pkg:oci/gleam?repository_url=ghcr.io%2Fgleam-lang",
          "product": "Gleam",
          "programFiles": [
            "compiler-cli/src/dependencies.rs",
            "compiler-core/src/manifest.rs",
            "compiler-core/src/paths.rs",
            "compiler-core/src/build/project_compiler.rs",
            "compiler-cli/src/fs.rs"
          ],
          "programRoutines": [
            {
              "name": "gleam_cli::dependencies::hex_manifest_package"
            },
            {
              "name": "gleam_core::manifest::ManifestPackage::application_name"
            },
            {
              "name": "gleam_core::paths::ProjectPaths::build_directory_for_package"
            },
            {
              "name": "gleam_core::build::project_compiler::ProjectCompiler::load_cache_or_compile_package"
            },
            {
              "name": "gleam_cli::fs::delete_directory"
            }
          ],
          "vendor": "Gleam",
          "versions": [
            {
              "lessThan": "v1.19.2-elixir",
              "status": "affected",
              "version": "v0.32.4-elixir",
              "versionType": "other"
            },
            {
              "lessThan": "v1.19.2-erlang",
              "status": "affected",
              "version": "v0.32.4-erlang",
              "versionType": "other"
            },
            {
              "lessThan": "v1.19.2-node",
              "status": "affected",
              "version": "v0.32.4-node",
              "versionType": "other"
            },
            {
              "lessThan": "v1.19.2-node-slim",
              "status": "affected",
              "version": "v0.32.4-node-slim",
              "versionType": "other"
            },
            {
              "lessThan": "v1.19.2-elixir-slim",
              "status": "affected",
              "version": "v0.32.4-elixir-slim",
              "versionType": "other"
            },
            {
              "lessThan": "v1.19.2-erlang-slim",
              "status": "affected",
              "version": "v0.32.4-erlang-slim",
              "versionType": "other"
            },
            {
              "lessThan": "v1.19.2-erlang-alpine",
              "status": "affected",
              "version": "v0.32.4-erlang-alpine",
              "versionType": "other"
            },
            {
              "lessThan": "v1.19.2-elixir-alpine",
              "status": "affected",
              "version": "v0.32.4-elixir-alpine",
              "versionType": "other"
            },
            {
              "lessThan": "v1.19.2-node-alpine",
              "status": "affected",
              "version": "v0.32.4-node-alpine",
              "versionType": "other"
            },
            {
              "lessThan": "v1.19.2-scratch",
              "status": "affected",
              "version": "v0.32.4-scratch",
              "versionType": "other"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "gleam_cli::dependencies",
            "gleam_core::manifest",
            "gleam_core::paths",
            "gleam_core::build::project_compiler",
            "gleam_cli::fs"
          ],
          "packageName": "gleam-lang/gleam",
          "packageURL": "pkg:github/gleam-lang/gleam",
          "product": "Gleam",
          "programFiles": [
            "compiler-cli/src/dependencies.rs",
            "compiler-core/src/manifest.rs",
            "compiler-core/src/paths.rs",
            "compiler-core/src/build/project_compiler.rs",
            "compiler-cli/src/fs.rs"
          ],
          "programRoutines": [
            {
              "name": "gleam_cli::dependencies::hex_manifest_package"
            },
            {
              "name": "gleam_core::manifest::ManifestPackage::application_name"
            },
            {
              "name": "gleam_core::paths::ProjectPaths::build_directory_for_package"
            },
            {
              "name": "gleam_core::build::project_compiler::ProjectCompiler::load_cache_or_compile_package"
            },
            {
              "name": "gleam_cli::fs::delete_directory"
            }
          ],
          "repo": "https://github.com/gleam-lang/gleam",
          "vendor": "Gleam",
          "versions": [
            {
              "changes": [
                {
                  "at": "d15c981fac6e533d70ac8ee89a6ef4dbf139adc3",
                  "status": "unaffected"
                },
                {
                  "at": "54bbb2b98af1505b6eed93c45b1936fc76412e5c",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "d13f27ee80aae7a521d2e9433c4deaf53f892574",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project\u0027s build directory when a developer builds a project.\n\nA Hex package release\u0027s metadata carries an app field with the release\u0027s OTP application name. Gleam reads this field from the hex.pm release API when it downloads dependencies and uses it as the package\u0027s build directory name without validating it (hex_manifest_package in compiler-cli/src/dependencies.rs, ProjectPaths::build_directory_for_package). When a dependency fails to compile, Gleam deletes that directory with remove_dir_all. hex.pm didn\u0027t restrict the field to a directory name before 2026-10-12, so a publisher could set it to a value such as ../../../../target or an absolute path. When a project depends on such a release directly or transitively and the release fails to compile, gleam build, gleam check, gleam run, gleam test or gleam export deletes the directory the name resolves to. For a pure Gleam package no publisher code runs.\n\nThis issue affects gleam: from 0.32.4 before 1.19.2."
    }
  ],
  "id": "CVE-2026-103061",
  "lastModified": "2026-10-13T14:31:20.750",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-10-12T19:16:36.387",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-103061.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/gleam-lang/gleam/commit/54bbb2b98af1505b6eed93c45b1936fc76412e5c"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/gleam-lang/gleam/commit/d13f27ee80aae7a521d2e9433c4deaf53f892574"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/gleam-lang/gleam/commit/d15c981fac6e533d70ac8ee89a6ef4dbf139adc3"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/gleam-lang/gleam/security/advisories/GHSA-jhcr-c7qm-8589"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-103061"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.