Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-96612— Path traversal in Hex via unvalidated dependency app names

Quick assessment

Affected
hexpm hex
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

hexpm hex 存在“对限制目录的路径名限制不当（路径遍历）”漏洞，允许恶意软件包发布者在开发者拉取依赖项时，删除项目 deps 目录外的任意目录，并将软件包文件解压至该目录中。 软件包版本元数据中包含一个标识依赖 OTP 应用程序名称的 标签。Hex 从仓库的签名注册表中获取该标签，并直接将其用作依赖项的应用程序名称，而未对其进行任何验证（见 和 ）。Mix 会将依赖项的检出目录路径构建为 ，而 会在该路径上调用 （递归强制删除目录）并将软件包内容解压至此目录。hex.pm 仅对 标签的长度进行校验，因此发布

CVSS 7.5 · High EPSS 0.40% · P33

Affected Version Matrix 2

VendorProduct Version RangeStatus
hexpm hex 0.6.0< 2.5.2 affected
380f87054e1bc08ee13d2b5311bc01f98dad2fc6< * affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-96612

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Path traversal in Hex via unvalidated dependency app names
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. A package release's requirements carry an app label that names the dependency's OTP application. Hex takes this label from the repository's signed registry and uses it as the dependency's application name without validating it (Hex.RemoteConverger.deps/2, Hex.Mix.to_lock/1). Mix derives the dependency's checkout directory as deps/<app>, and Hex.SCM.update/1 runs File.rm_rf!/1 on that directory and unpacks the package into it. hex.pm only checks the label's length, so a publisher can set it to a value such as ../../target. When a project depends on such a release directly or transitively, mix deps.get or mix deps.update deletes the directory the label resolves to and writes the labelled package's files there. This happens before any dependency code is compiled. This issue affects hex: from 0.6.0 before 2.5.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
hexpm hex 0.6.0 ~ 2.5.2 cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*
hexpm hex 380f87054e1bc08ee13d2b5311bc01f98dad2fc6 ~ * cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-96612

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-96612

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-96612 (2)

Vendor Advisories for CVE-2026-96612 (3)

Same Patch Batch · hexpm · 2026-10-12 · 7 CVEs total

CVE-2026-105668 7.1 HIGH Hex release-age cooldown is lifted package-wide when the locked release is retired
CVE-2026-105280 6.9 MEDIUM Hex writes unverified package tarballs to standard output in mix hex.package fetch
CVE-2026-103502 5.9 MEDIUM hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
CVE-2026-103503 5.9 MEDIUM Hex trusts its bundled CA certificates when cacerts_path is set
CVE-2026-81856 2.3 LOW Terminal escape sequence injection in Hex via unneutralized server-supplied output
CVE-2026-96618 2.1 LOW Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

IV. Related Vulnerabilities

Same product: hex
Same vendor: hexpm
Same weakness: CWE-22

V. Comments for CVE-2026-96612

No comments yet

Leave a comment