Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-103060— Path traversal in rebar3 via unvalidated dependency app names

Quick assessment

Affected
erlang rebar3
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Erlang 构建工具 rebar3 中存在一处“受限目录的路径名限制不当（路径遍历）”漏洞。该漏洞允许恶意软件包发布者在开发者获取依赖项时，删除项目 目录之外的目录，并将软件包文件提取到该目录中。 Hex 注册表中发布的软件包依赖项包含一个 字段，用于指定该依赖项的 OTP 应用程序名称。rebar3 在使用此字段作为依赖项名称时未对其进行验证（见 函数），并直接基于该名称构建依赖项的目录路径（见 函数）。随后， 函数会使用 命令删除该目录，并将下载的包移动至其中。 在 2026 年 10 月 12 日之前，he

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-103060

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Path traversal in rebar3 via unvalidated dependency app names
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's _build directory and extract package files into it when a developer fetches dependencies. A package release's dependencies in a Hex registry carry an app field that names the dependency's OTP application. rebar3 uses this field as the dependency's name without validating it (rebar_packages:parse_deps/1) and builds the dependency's directory from that name (rebar_app_utils:dep_to_app/7). rebar_fetch:download_source_online/2 deletes that directory with rm -rf and moves the fetched package into it. hex.pm didn't restrict the field to a directory name before 2026-10-12, so a publisher could set it to a value such as ../../../../target. When a project depends on such a release directly or transitively, rebar3 get-deps deletes the directory the name resolves to and writes the dependency's files there. This happens before the dependency's own rebar.config.script is evaluated, and get-deps compiles nothing. This issue affects rebar3: from 3.7.0-rc1 before 3.27.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
erlang rebar3 3.7.0-rc1 ~ 3.27.2 cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*
erlang rebar3 56b7d88975aa8da6446857cfd92de0825024bf63 ~ e35282b26e499b1d9e8f30bba9dccd71cd8b02ba cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-103060

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-103060

请登录查看更多情报信息。

Other References for CVE-2026-103060 (5)

IV. Related Vulnerabilities

Same product: rebar3
Same vendor: erlang
Same weakness: CWE-22

V. Comments for CVE-2026-103060

No comments yet

Leave a comment