Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-103061— Path traversal in Gleam via unvalidated package application names

Quick assessment

Affected
Gleam Gleam
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

gleam-lang gleam 中存在一个“路径遍历”（Path Traversal）漏洞，具体表现为对受限目录的路径名限制不当。该漏洞允许恶意软件包发布者在开发者构建项目时，删除项目构建目录之外的目录。 Hex 软件包发布元数据中包含一个 字段，用于指定该发布的 OTP 应用程序名称。gleam 在下载依赖项时，会从 hex.pm 的发布 API 读取此字段，并直接将其用作软件包的构建目录名称，而未对其进行验证（相关代码位于 中的 和 ）。当某个依赖项编译失败时，gleam 会通过 删除对应的目录。 在 202

CVSS 5.9 · Medium EPSS 0.40% · P33

Affected Version Matrix 12

VendorProduct Version RangeStatus
Gleam Gleam 0.32.4< 1.19.2 affected
v0.32.4-elixir< v1.19.2-elixir affected
v0.32.4-erlang< v1.19.2-erlang affected
v0.32.4-node< v1.19.2-node affected
v0.32.4-node-slim< v1.19.2-node-slim affected
v0.32.4-elixir-slim< v1.19.2-elixir-slim affected
v0.32.4-erlang-slim< v1.19.2-erlang-slim affected
v0.32.4-erlang-alpine< v1.19.2-erlang-alpine affected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-103061

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Path traversal in Gleam via unvalidated package application names
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project's build directory when a developer builds a project. A Hex package release's metadata carries an app field with the release's OTP application name. Gleam reads this field from the hex.pm release API when it downloads dependencies and uses it as the package's build directory name without validating it (hex_manifest_package in compiler-cli/src/dependencies.rs, ProjectPaths::build_directory_for_package). When a dependency fails to compile, Gleam deletes that directory with remove_dir_all. hex.pm didn't restrict the field to a directory name before 2026-10-12, so a publisher could set it to a value such as ../../../../target or an absolute path. When a project depends on such a release directly or transitively and the release fails to compile, gleam build, gleam check, gleam run, gleam test or gleam export deletes the directory the name resolves to. For a pure Gleam package no publisher code runs. This issue affects gleam: from 0.32.4 before 1.19.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Gleam Gleam 0.32.4 ~ 1.19.2 cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*
Gleam Gleam v0.32.4-elixir ~ v1.19.2-elixir cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*
Gleam Gleam d13f27ee80aae7a521d2e9433c4deaf53f892574 ~ * cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-103061

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-103061

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-103061 (2)

Vendor Advisories for CVE-2026-103061 (2)

Other References for CVE-2026-103061 (1)

IV. Related Vulnerabilities

Same product: Gleam
Same vendor: Gleam
Same weakness: CWE-22

V. Comments for CVE-2026-103061

No comments yet

Leave a comment