Read the docs
TI-2026-24683 Aliases CVE-2026-32146

Improper Path Validation in Git Dependency Handling Allows Arbitrary File System Modification

Priority HIGH 69CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Improper path validation vulnerability in the Gleam compiler's handling of git dependencies allows arbitrary file system modification during dependency download. Dependency names from gleam.toml and manifest.toml are incorporated into filesystem paths without sufficient validation or confinement to the intended dependency directory, allowing attacker-controlled paths (via relative traversal such as ../ or absolute paths) to target filesystem locations outside that directory. When resolving git dependencies (e.g. via gleam deps download), the computed path is used for filesystem operations including directory deletion and creation. This vulnerability occurs during the dependency resolution and download phase, which is generally expected to be limited to fetching and preparing dependencies within a confined directory. A malicious direct or transitive git dependency can exploit this issue to delete and overwrite arbitrary directories outside the intended dependency directory, including attacker-chosen absolute paths, potentially causing data loss. In some environments, this may be further leveraged to achieve code execution, for example by overwriting git hooks or shell configuration files. This issue affects Gleam from 1.9.0-rc1 until 1.15.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00239 15th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Gleam (Gleam): v1.15.4-elixir, v1.15.4-erlang, v1.15.4-node +7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GleamGleam1.9.0-rc1 and later—No fix listedCNA
GleamGleam1.9.0-rc1 and later—No fix listedCNA
GleamGleamv1.9.0-rc1-elixir to before v1.15.4-elixir; v1.9.0-rc1-erlang to before v1.15.4-erlang; v1.9.0-rc1-node to before v1.15.4-node; v1.9.0-rc1-node-slim to before v1.15.4-node-slim; v1.9.0-rc1-elixir-slim to before v1.15.4-elixir-slim; v1.9.0-rc1-erlang-slim to before v1.15.4-erlang-slim; v1.9.0-rc1-erlang-alpine to before v1.15.4-erlang-alpine; v1.9.0-rc1-elixir-alpine to before v1.15.4-elixir-alpine; v1.9.0-rc1-node-alpine to before v1.15.4-node-alpine; v1.9.0-rc1-scratch to before v1.15.4-scratchv1.15.4-elixir, v1.15.4-erlang, v1.15.4-node, v1.15.4-node-slim, v1.15.4-elixir-slim, v1.15.4-erlang-slim, v1.15.4-erlang-alpine, v1.15.4-elixir-alpine, v1.15.4-node-alpine, v1.15.4-scratchPatch availableCNA
  • Gleam VendorGleam Affected 1.9.0-rc1 and later Fixed in — No fix listed CNA
  • Gleam VendorGleam Affected 1.9.0-rc1 and later Fixed in — No fix listed CNA
  • Gleam VendorGleam Affected v1.9.0-rc1-elixir to before v1.15.4-elixir; v1.9.0-rc1-erlang to before v1.15.4-erlang; v1.9.0-rc1-node to before v1.15.4-node; v1.9.0-rc1-node-slim to before v1.15.4-node-slim; v1.9.0-rc1-elixir-slim to before v1.15.4-elixir-slim; v1.9.0-rc1-erlang-slim to before v1.15.4-erlang-slim; v1.9.0-rc1-erlang-alpine to before v1.15.4-erlang-alpine; v1.9.0-rc1-elixir-alpine to before v1.15.4-elixir-alpine; v1.9.0-rc1-node-alpine to before v1.15.4-node-alpine; v1.9.0-rc1-scratch to before v1.15.4-scratch Fixed in v1.15.4-elixir, v1.15.4-erlang, v1.15.4-node, v1.15.4-node-slim, v1.15.4-elixir-slim, v1.15.4-erlang-slim, v1.15.4-erlang-alpine, v1.15.4-elixir-alpine, v1.15.4-node-alpine, v1.15.4-scratch Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lpil:gleam:*:*:*:*:*:*:*:*1.9.0 to before 1.15.4VulnerableLpil
  • cpe:2.3:a:lpil:gleam:*:*:*:*:*:*:*:* Versions 1.9.0 to before 1.15.4 Vulnerable ·Lpil

Remediation

  • Fix · CNA Gleam (Gleam) Fixed in v1.15.4-elixir, v1.15.4-erlang, v1.15.4-node, v1.15.4-node-slim, v1.15.4-elixir-slim, v1.15.4-erlang-slim, v1.15.4-erlang-alpine, v1.15.4-elixir-alpine, v1.15.4-node-alpine, v1.15.4-scratch

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32146

References

Exploit 1

Patch 2

Advisory 2

  • TI-2026-32010 Path Traversal in build/packages/packages.toml Allows Arbitrary Directory Deletion CVSS 4.0MEDIUM 5.6
  • TI-2026-31015 Symlink Following in Hex Package Export Allows Embedding Files Outside Project Root CVSS 4.0MEDIUM 5.1
  • TI-2026-25177 Path Traversal in gleam docs build via documentation.pages Allows Arbitrary File Read and Write CVSS 4.0MEDIUM 4.6
  • TI-2026-71223 Path traversal in Gleam via unvalidated package application names CVSS 4.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences