CVE-2026-103060

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-103060
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103060.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-103060
Aliases
Published
2026-10-12T15:43:57Z
Modified
2026-10-13T02:45:30Z
Severity
  • 7.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Path traversal in rebar3 via unvalidated dependency app names
Details

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's _build directory and extract package files into it when a developer fetches dependencies.

A package release's dependencies in a Hex registry carry an app field that names the dependency's OTP application. rebar3 uses this field as the dependency's name without validating it (rebar_packages:parse_deps/1) and builds the dependency's directory from that name (rebar_app_utils:dep_to_app/7). rebar_fetch:download_source_online/2 deletes that directory with rm -rf and moves the fetched package into it. hex.pm didn't restrict the field to a directory name before 2026-10-12, so a publisher could set it to a value such as ../../../../target. When a project depends on such a release directly or transitively, rebar3 get-deps deletes the directory the name resolves to and writes the dependency's files there. This happens before the dependency's own rebar.config.script is evaluated, and get-deps compiles nothing.

This issue affects rebar3: from 3.7.0-rc1 before 3.27.2.

Database specific 
{
    "cna_assigner":  "EEF",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103060.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "3.7.0-rc1"
                },
                {
                    "fixed":  "3.27.2"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/erlang/rebar3

Affected ranges

Type
GIT
Repo
https://github.com/erlang/rebar3
Events
Introduced
56b7d88975aa8da6446857cfd92de0825024bf63
Fixed
e35282b26e499b1d9e8f30bba9dccd71cd8b02ba

Affected versions

3.*
3.11.0
3.11.1
3.12.0
3.13.0
3.14.0
3.14.0-rc1
3.14.0-rc2
3.14.1
3.14.2
3.14.4
3.15.0
3.15.1
3.16.0
3.16.1
3.17.0
3.18.0
3.19.0
3.20.0
3.21.0
3.22.0
3.22.1
3.23.0
3.24.0
3.25.0
3.25.1
3.26.0
3.27.0
3.27.1
3.7.0
3.7.0-rc1
3.7.0-rc2
3.7.1
3.7.2
3.7.3
3.7.4
3.7.5
3.8.0
3.9.0
3.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103060.json"