CVE-2026-103060
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A vulnerability in rebar3 allows a malicious package publisher to delete a directory outside the project's _build directory and extract package files into it when dependencies are fetched. The app field in Hex dependencies is used without validation as a directory name, enabling paths like ../../../../target. Affects rebar3 from 3.7.0-rc1 before 3.27.2.
Risk Assessment
An attacker can delete important project files and write their own data, potentially leading to arbitrary file writes and project integrity compromise.
Recommendation
Update rebar3 to version 3.27.2 or later. Verify trust in dependency sources.
Related vulnerabilities
- CVE-2026-113744Critical
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the httpd Web Management Service component. Manipulation of the firewallEn argument leads to a stack-based buffer overflow. The attack may be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-114119Critical
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.
- CVE-2026-114108Critical
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.
- CVE-2026-113736Critical
A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the HNAP Login component. Manipulation of the Password argument leads to an empty password in the configuration file. The attack can be initiated remotely and the exploit has been disclosed to the public.
- CVE-2026-92559Critical
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.
- CVE-2026-91665Critical
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows an unauthenticated attacker with network access via TCP to compromise Oracle Essbase. CVSS 3.1 Base Score 9.8.
- CVE-2026-91663Critical
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows a low-privileged attacker with network access via T3, IIOP to compromise Oracle Essbase, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.9.
- CVE-2026-91658Critical
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Essbase, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.9.
- CVE-2026-91656Critical
Vulnerability in Oracle Essbase (component: Federated Partitions) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data, update, insert or delete it, and cause a partial denial of service, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.1.
- CVE-2026-91655Critical
Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. A low-privileged attacker with network access via HTTP can exploit it to gain unauthorized access to critical data, modify data, and cause partial denial of service. CVSS 9.1.
Original NVD description (English source)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's _build directory and extract package files into it when a developer fetches dependencies. A package release's dependencies in a Hex registry carry an app field that names the dependency's OTP application. rebar3 uses this field as the dependency's name without validating it (rebar_packages:parse_deps/1) and builds the dependency's directory from that name (rebar_app_utils:dep_to_app/7). rebar_fetch:download_source_online/2 deletes that directory with rm -rf and moves the fetched package into it. hex.pm didn't restrict the field to a directory name before 2026-10-12, so a publisher could set it to a value such as ../../../../target. When a project depends on such a release directly or transitively, rebar3 get-deps deletes the directory the name resolves to and writes the dependency's files there. This happens before the dependency's own rebar.config.script is evaluated, and get-deps compiles nothing. This issue affects rebar3: from 3.7.0-rc1 before 3.27.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS