Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-32146— Improper Path Validation in Git Dependency Handling Allows Arbitrary File System Modification

Quick assessment

Affected
Gleam Gleam
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

gleam是Gleam开源的一个类型安全的可扩展系统构建语言。 gleam 1.15.3及之前的1.9.0-rc1版本和1.16.0-rc1之前版本存在安全漏洞，该漏洞源于处理git依赖时路径验证不当，可能导致任意文件系统修改。

CVSS 8.3 · High EPSS 0.22% · P12

Affected Version Matrix 13

VendorProduct Version RangeStatus
Gleam Gleam 1.9.0-rc1< * affected
1.9.0-rc1< * affected
a4fde22445ab8e5cc79c2ff48971616cb570702c< * affected
v1.9.0-rc1-elixir< v1.15.4-elixir affected
v1.9.0-rc1-erlang< v1.15.4-erlang affected
v1.9.0-rc1-node< v1.15.4-node affected
v1.9.0-rc1-node-slim< v1.15.4-node-slim affected
v1.9.0-rc1-elixir-slim< v1.15.4-elixir-slim affected
… +5 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-32146

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Improper Path Validation in Git Dependency Handling Allows Arbitrary File System Modification
Source: CVE Program / CVE List V5
Vulnerability Description
Improper path validation vulnerability in the Gleam compiler's handling of git dependencies allows arbitrary file system modification during dependency download. Dependency names from gleam.toml and manifest.toml are incorporated into filesystem paths without sufficient validation or confinement to the intended dependency directory, allowing attacker-controlled paths (via relative traversal such as ../ or absolute paths) to target filesystem locations outside that directory. When resolving git dependencies (e.g. via gleam deps download), the computed path is used for filesystem operations including directory deletion and creation. This vulnerability occurs during the dependency resolution and download phase, which is generally expected to be limited to fetching and preparing dependencies within a confined directory. A malicious direct or transitive git dependency can exploit this issue to delete and overwrite arbitrary directories outside the intended dependency directory, including attacker-chosen absolute paths, potentially causing data loss. In some environments, this may be further leveraged to achieve code execution, for example by overwriting git hooks or shell configuration files. This issue affects Gleam from 1.9.0-rc1 until 1.15.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
gleam 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
gleam是Gleam开源的一个类型安全的可扩展系统构建语言。 gleam 1.15.3及之前的1.9.0-rc1版本和1.16.0-rc1之前版本存在安全漏洞，该漏洞源于处理git依赖时路径验证不当，可能导致任意文件系统修改。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Gleam Gleam 1.9.0-rc1 ~ * cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*
Gleam Gleam 1.9.0-rc1 ~ * cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*
Gleam Gleam v1.9.0-rc1-elixir ~ v1.15.4-elixir cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-32146

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-32146

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-32146 (3)

Vendor Advisories for CVE-2026-32146 (3)

IV. Related Vulnerabilities

Same product: Gleam
Same vendor: Gleam
Same weakness: CWE-22

V. Comments for CVE-2026-32146

No comments yet

Leave a comment