Read the docs
TI-2026-31015 Aliases CVE-2026-42795

Symlink Following in Hex Package Export Allows Embedding Files Outside Project Root

Priority MEDIUM 56CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-59 and the CVSS impact.

Summary

Symlink following vulnerability in Gleam's Hex package export allows files outside the project root to be embedded in the generated package tarball. The file collection helpers (gleam_files, native_files, private_files) in compiler-cli/src/fs.rs use follow_links(true) when walking publishable directories such as src/ and priv/. The collected paths are added to the package archive via add_path_to_tar in compiler-cli/src/publish.rs without verifying that the resolved target remains within the project root. A symlink placed under a publishable directory will cause gleam export hex-tarball or gleam publish to embed the contents of the symlink target into the generated Hex package. An attacker with write access to the project repository can place a symlink in src/ or priv/ pointing to an arbitrary file. When a maintainer or CI pipeline runs gleam publish or gleam export hex-tarball, local files readable by the publisher (such as secrets, tokens, or SSH keys) are silently embedded into the published package artifact. This issue affects Gleam from 0.10.0-rc1 until 1.17.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00199 9th percentileScored 2026-11-07
Fix Fixed Gleam (Gleam): 1.17.0, v1.17.0-elixir, v1.17.0-erlang +8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GleamGleam0.10.0-rc1 to before 1.17.01.17.0Patch availableCNA
GleamGleam0.10.0-rc1 to before 1.17.01.17.0Patch availableCNA
GleamGleamv0.10.0-rc1-elixir to before v1.17.0-elixir; v0.10.0-rc1-erlang to before v1.17.0-erlang; v0.10.0-rc1-node to before v1.17.0-node; v0.10.0-rc1-node-slim to before v1.17.0-node-slim; v0.10.0-rc1-elixir-slim to before v1.17.0-elixir-slim; v0.10.0-rc1-erlang-slim to before v1.17.0-erlang-slim; v0.10.0-rc1-erlang-alpine to before v1.17.0-erlang-alpine; v0.10.0-rc1-elixir-alpine to before v1.17.0-elixir-alpine; v0.10.0-rc1-node-alpine to before v1.17.0-node-alpine; v0.10.0-rc1-scratch to before v1.17.0-scratchv1.17.0-elixir, v1.17.0-erlang, v1.17.0-node, v1.17.0-node-slim, v1.17.0-elixir-slim, v1.17.0-erlang-slim, v1.17.0-erlang-alpine, v1.17.0-elixir-alpine, v1.17.0-node-alpine, v1.17.0-scratchPatch availableCNA
  • Gleam VendorGleam Affected 0.10.0-rc1 to before 1.17.0 Fixed in 1.17.0 Patch available CNA
  • Gleam VendorGleam Affected 0.10.0-rc1 to before 1.17.0 Fixed in 1.17.0 Patch available CNA
  • Gleam VendorGleam Affected v0.10.0-rc1-elixir to before v1.17.0-elixir; v0.10.0-rc1-erlang to before v1.17.0-erlang; v0.10.0-rc1-node to before v1.17.0-node; v0.10.0-rc1-node-slim to before v1.17.0-node-slim; v0.10.0-rc1-elixir-slim to before v1.17.0-elixir-slim; v0.10.0-rc1-erlang-slim to before v1.17.0-erlang-slim; v0.10.0-rc1-erlang-alpine to before v1.17.0-erlang-alpine; v0.10.0-rc1-elixir-alpine to before v1.17.0-elixir-alpine; v0.10.0-rc1-node-alpine to before v1.17.0-node-alpine; v0.10.0-rc1-scratch to before v1.17.0-scratch Fixed in v1.17.0-elixir, v1.17.0-erlang, v1.17.0-node, v1.17.0-node-slim, v1.17.0-elixir-slim, v1.17.0-erlang-slim, v1.17.0-erlang-alpine, v1.17.0-elixir-alpine, v1.17.0-node-alpine, v1.17.0-scratch Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA Gleam (Gleam) Fixed in 1.17.0
  • Fix · CNA Gleam (Gleam) Fixed in 1.17.0
  • Fix · CNA Gleam (Gleam) Fixed in v1.17.0-elixir, v1.17.0-erlang, v1.17.0-node, v1.17.0-node-slim, v1.17.0-elixir-slim, v1.17.0-erlang-slim, v1.17.0-erlang-alpine, v1.17.0-elixir-alpine, v1.17.0-node-alpine, v1.17.0-scratch

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Gleam 1.17.0, v1.17.0-elixir and 9 more versions

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-32010 Path Traversal in build/packages/packages.toml Allows Arbitrary Directory DeletionPriority MEDIUM 58
    • TI-2026-25177 Path Traversal in gleam docs build via documentation.pages Allows Arbitrary File Read and WritePriority MEDIUM 54
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42795

References

Patch 1

Advisory 1

Other 2

  • TI-2026-32010 Path Traversal in build/packages/packages.toml Allows Arbitrary Directory Deletion CVSS 4.0MEDIUM 5.6
  • TI-2026-25177 Path Traversal in gleam docs build via documentation.pages Allows Arbitrary File Read and Write CVSS 4.0MEDIUM 4.6
  • TI-2026-71223 Path traversal in Gleam via unvalidated package application names CVSS 4.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences