Read the docs
TI-2026-25177 Aliases CVE-2026-32685

Path Traversal in gleam docs build via documentation.pages Allows Arbitrary File Read and Write

Priority MEDIUM 54CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Path traversal vulnerability in Gleam's handling of custom documentation pages allows arbitrary file read and file write outside the intended documentation output directory. The documentation.pages entries from gleam.toml are incorporated into filesystem paths without sufficient validation or confinement to the intended project and documentation output directories. The documentation.pages[].path field can be used to write generated documentation files outside the intended build/dev/docs/<package>/ output directory. The documentation.pages[].source field can be used to read files outside the project directory and embed their contents into generated documentation output. An attacker who can convince a victim to run gleam docs build on an untrusted project, or with untrusted gleam.toml content, can cause local files readable by the victim to be included in generated documentation artifacts, and can cause generated documentation files to be written outside the intended docs output directory. This issue affects Gleam from 1.16.0 until 1.17.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00229 13th percentileScored 2026-11-07
Fix Fixed Gleam (Gleam): 1.17.0, v1.17.0-elixir, v1.17.0-erlang +8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GleamGleam1.16.0 to before 1.17.01.17.0Patch availableCNA
GleamGleam1.16.0 to before 1.17.01.17.0Patch availableCNA
GleamGleamv1.16.0-elixir to before v1.17.0-elixir; v1.16.0-erlang to before v1.17.0-erlang; v1.16.0-node to before v1.17.0-node; v1.16.0-node-slim to before v1.17.0-node-slim; v1.16.0-elixir-slim to before v1.17.0-elixir-slim; v1.16.0-erlang-slim to before v1.17.0-erlang-slim; v1.16.0-erlang-alpine to before v1.17.0-erlang-alpine; v1.16.0-elixir-alpine to before v1.17.0-elixir-alpine; v1.16.0-node-alpine to before v1.17.0-node-alpine; v1.16.0-scratch to before v1.17.0-scratchv1.17.0-elixir, v1.17.0-erlang, v1.17.0-node, v1.17.0-node-slim, v1.17.0-elixir-slim, v1.17.0-erlang-slim, v1.17.0-erlang-alpine, v1.17.0-elixir-alpine, v1.17.0-node-alpine, v1.17.0-scratchPatch availableCNA
  • Gleam VendorGleam Affected 1.16.0 to before 1.17.0 Fixed in 1.17.0 Patch available CNA
  • Gleam VendorGleam Affected 1.16.0 to before 1.17.0 Fixed in 1.17.0 Patch available CNA
  • Gleam VendorGleam Affected v1.16.0-elixir to before v1.17.0-elixir; v1.16.0-erlang to before v1.17.0-erlang; v1.16.0-node to before v1.17.0-node; v1.16.0-node-slim to before v1.17.0-node-slim; v1.16.0-elixir-slim to before v1.17.0-elixir-slim; v1.16.0-erlang-slim to before v1.17.0-erlang-slim; v1.16.0-erlang-alpine to before v1.17.0-erlang-alpine; v1.16.0-elixir-alpine to before v1.17.0-elixir-alpine; v1.16.0-node-alpine to before v1.17.0-node-alpine; v1.16.0-scratch to before v1.17.0-scratch Fixed in v1.17.0-elixir, v1.17.0-erlang, v1.17.0-node, v1.17.0-node-slim, v1.17.0-elixir-slim, v1.17.0-erlang-slim, v1.17.0-erlang-alpine, v1.17.0-elixir-alpine, v1.17.0-node-alpine, v1.17.0-scratch Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA Gleam (Gleam) Fixed in 1.17.0
  • Fix · CNA Gleam (Gleam) Fixed in 1.17.0
  • Fix · CNA Gleam (Gleam) Fixed in v1.17.0-elixir, v1.17.0-erlang, v1.17.0-node, v1.17.0-node-slim, v1.17.0-elixir-slim, v1.17.0-erlang-slim, v1.17.0-erlang-alpine, v1.17.0-elixir-alpine, v1.17.0-node-alpine, v1.17.0-scratch

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Gleam 1.17.0, v1.17.0-elixir and 9 more versions

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-32010 Path Traversal in build/packages/packages.toml Allows Arbitrary Directory DeletionPriority MEDIUM 58
    • TI-2026-31015 Symlink Following in Hex Package Export Allows Embedding Files Outside Project RootPriority MEDIUM 56
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32685

References

Patch 2

Advisory 1

Other 2

  • TI-2026-32010 Path Traversal in build/packages/packages.toml Allows Arbitrary Directory Deletion CVSS 4.0MEDIUM 5.6
  • TI-2026-31015 Symlink Following in Hex Package Export Allows Embedding Files Outside Project Root CVSS 4.0MEDIUM 5.1
  • TI-2026-71223 Path traversal in Gleam via unvalidated package application names CVSS 4.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences