CVE-2026-103060
Received Received - Intake

Path Traversal in rebar3 Dependency Handling

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: EEF

Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's _build directory and extract package files into it when a developer fetches dependencies. A package release's dependencies in a Hex registry carry an app field that names the dependency's OTP application. rebar3 uses this field as the dependency's name without validating it (rebar_packages:parse_deps/1) and builds the dependency's directory from that name (rebar_app_utils:dep_to_app/7). rebar_fetch:download_source_online/2 deletes that directory with rm -rf and moves the fetched package into it. hex.pm didn't restrict the field to a directory name before 2026-10-12, so a publisher could set it to a value such as ../../../../target. When a project depends on such a release directly or transitively, rebar3 get-deps deletes the directory the name resolves to and writes the dependency's files there. This happens before the dependency's own rebar.config.script is evaluated, and get-deps compiles nothing. This issue affects rebar3: from 3.7.0-rc1 before 3.27.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-103060
EUVD
EUVD-2026-97510

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
erlang rebar3 3.7.0-rc1
erlang rebar3 56b7d88975aa8da6446857cfd92de0825024bf63

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-103060 is a path traversal vulnerability in rebar3, an Erlang build tool. It occurs because rebar3 uses the app field from a package's dependency metadata as a directory name without validating it. An attacker can craft a malicious app field with path traversal sequences like ../../../../target to delete or overwrite directories outside the project's _build directory when dependencies are fetched.

Detection Guidance

Check if your rebar3 version is vulnerable by running: rebar3 version. If it falls between 3.7.0-rc1 and 3.27.1, it is affected. Inspect dependency names in rebar.lock or rebar.config for path traversal sequences like ../../../../. Monitor for unexpected directory deletions or file overwrites in _build or system directories during dependency resolution.

Impact Analysis

This vulnerability can allow an attacker to delete critical directories or overwrite important files outside the project's _build directory. This could lead to loss of data, unauthorized code execution if overwritten files are later executed, or disruption of development or CI environments.

Mitigation Strategies

Upgrade rebar3 to version 3.27.2 or later immediately. Avoid fetching dependencies from untrusted sources. Review and validate dependency names in rebar.config and rebar.lock for path traversal patterns. Consider using filename:safe_relative_path/1 for manual validation if needed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103060. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart