CVE-2026-32685
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Path traversal vulnerability in Gleam's custom documentation pages handling (versions 1.16.0 through 1.17.0) allows arbitrary file read and write outside the intended documentation output directory. The documentation.pages[].path and .source fields are used without sufficient validation.
Risk Assessment
An attacker can trick a victim into running a command on an untrusted project, leading to inclusion of local files in documentation or writing files outside the intended directory.
Recommendation
Update Gleam to version 1.17.0 or later.
Other vulnerabilities in Gleam
See all- CVE-2026-59247High
A vulnerability in Gleam allows a man-in-the-middle attacker to substitute forged Hex package contents during dependency resolution due to insufficient verification of data authenticity. The second request to the unsigned Hex API is used instead of verified repository metadata.
- CVE-2026-43965Medium
Path traversal vulnerability in Gleam's dependency management (versions 0.18.0-rc1 through 1.17.0) allows arbitrary directory deletion via malicious build/packages/packages.toml content. Package keys are used without validation to construct paths, allowing ../ sequences to escape the intended directory.
- CVE-2026-42795Medium
A symlink following vulnerability in Gleam's Hex package export allows files outside the project root to be embedded in the generated package tarball. File collection helpers use follow_links(true) when walking publishable directories, and paths are added to the archive without verifying that the resolved target remains within the project root.
- CVE-2026-32146High
A path validation vulnerability in the Gleam compiler's handling of git dependencies allows arbitrary file system modification during dependency download. Dependency names from gleam.toml and manifest.toml are used in filesystem paths without sufficient validation, enabling path traversal (e.g., ../) to access files outside the intended dependency directory. A malicious dependency can delete or overwrite arbitrary directories, potentially leading to data loss or code execution.
Original NVD description (English source)
Path traversal vulnerability in Gleam's handling of custom documentation pages allows arbitrary file read and file write outside the intended documentation output directory. The documentation.pages entries from gleam.toml are incorporated into filesystem paths without sufficient validation or confinement to the intended project and documentation output directories. The documentation.pages[].path field can be used to write generated documentation files outside the intended build/dev/docs/<package>/ output directory. The documentation.pages[].source field can be used to read files outside the project directory and embed their contents into generated documentation output. An attacker who can convince a victim to run gleam docs build on an untrusted project, or with untrusted gleam.toml content, can cause local files readable by the victim to be included in generated documentation artifacts, and can cause generated documentation files to be written outside the intended docs output directory. This issue affects Gleam from 1.16.0 until 1.17.0.