Read the docs
TI-2026-32010 Aliases CVE-2026-43965

Path Traversal in build/packages/packages.toml Allows Arbitrary Directory Deletion

Priority MEDIUM 58CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Path traversal vulnerability in Gleam's dependency management allows arbitrary directory deletion via malicious build/packages/packages.toml content. Package keys read from build/packages/packages.toml by LocalPackages::read_from_disc are passed without validation to paths.build_packages_package(), which constructs a filesystem path by joining the project build directory with the attacker-controlled key. The resulting path is then passed to fs::delete_directory (which calls remove_dir_all). No check is performed to ensure the path remains within the intended build/packages/ directory. Both absolute paths and relative traversal sequences (e.g. ../) are accepted as package keys, allowing deletion of arbitrary directories. An attacker who can cause a victim to run gleam deps download on a project containing a malicious build/packages/packages.toml (e.g. by committing the normally-gitignored file to a repository) can cause arbitrary directories on the victim's system to be recursively deleted. This issue affects Gleam from 0.18.0-rc1 until 1.17.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00229 13th percentileScored 2026-11-07
Fix Fixed Gleam (Gleam): 1.17.0, v1.17.0-elixir, v1.17.0-erlang +8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GleamGleam0.18.0-rc1 to before 1.17.01.17.0Patch availableCNA
GleamGleam0.18.0-rc1 to before 1.17.01.17.0Patch availableCNA
GleamGleamv0.18.0-rc1-elixir to before v1.17.0-elixir; v0.18.0-rc1-erlang to before v1.17.0-erlang; v0.18.0-rc1-node to before v1.17.0-node; v0.18.0-rc1-node-slim to before v1.17.0-node-slim; v0.18.0-rc1-elixir-slim to before v1.17.0-elixir-slim; v0.18.0-rc1-erlang-slim to before v1.17.0-erlang-slim; v0.18.0-rc1-erlang-alpine to before v1.17.0-erlang-alpine; v0.18.0-rc1-elixir-alpine to before v1.17.0-elixir-alpine; v0.18.0-rc1-node-alpine to before v1.17.0-node-alpine; v0.18.0-rc1-scratch to before v1.17.0-scratchv1.17.0-elixir, v1.17.0-erlang, v1.17.0-node, v1.17.0-node-slim, v1.17.0-elixir-slim, v1.17.0-erlang-slim, v1.17.0-erlang-alpine, v1.17.0-elixir-alpine, v1.17.0-node-alpine, v1.17.0-scratchPatch availableCNA
  • Gleam VendorGleam Affected 0.18.0-rc1 to before 1.17.0 Fixed in 1.17.0 Patch available CNA
  • Gleam VendorGleam Affected 0.18.0-rc1 to before 1.17.0 Fixed in 1.17.0 Patch available CNA
  • Gleam VendorGleam Affected v0.18.0-rc1-elixir to before v1.17.0-elixir; v0.18.0-rc1-erlang to before v1.17.0-erlang; v0.18.0-rc1-node to before v1.17.0-node; v0.18.0-rc1-node-slim to before v1.17.0-node-slim; v0.18.0-rc1-elixir-slim to before v1.17.0-elixir-slim; v0.18.0-rc1-erlang-slim to before v1.17.0-erlang-slim; v0.18.0-rc1-erlang-alpine to before v1.17.0-erlang-alpine; v0.18.0-rc1-elixir-alpine to before v1.17.0-elixir-alpine; v0.18.0-rc1-node-alpine to before v1.17.0-node-alpine; v0.18.0-rc1-scratch to before v1.17.0-scratch Fixed in v1.17.0-elixir, v1.17.0-erlang, v1.17.0-node, v1.17.0-node-slim, v1.17.0-elixir-slim, v1.17.0-erlang-slim, v1.17.0-erlang-alpine, v1.17.0-elixir-alpine, v1.17.0-node-alpine, v1.17.0-scratch Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA Gleam (Gleam) Fixed in 1.17.0
  • Fix · CNA Gleam (Gleam) Fixed in 1.17.0
  • Fix · CNA Gleam (Gleam) Fixed in v1.17.0-elixir, v1.17.0-erlang, v1.17.0-node, v1.17.0-node-slim, v1.17.0-elixir-slim, v1.17.0-erlang-slim, v1.17.0-erlang-alpine, v1.17.0-elixir-alpine, v1.17.0-node-alpine, v1.17.0-scratch

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Gleam 1.17.0, v1.17.0-elixir and 9 more versions

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-31015 Symlink Following in Hex Package Export Allows Embedding Files Outside Project RootPriority MEDIUM 56
    • TI-2026-25177 Path Traversal in gleam docs build via documentation.pages Allows Arbitrary File Read and WritePriority MEDIUM 54
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-43965

References

Patch 1

Advisory 1

Other 2

  • TI-2026-31015 Symlink Following in Hex Package Export Allows Embedding Files Outside Project Root CVSS 4.0MEDIUM 5.1
  • TI-2026-25177 Path Traversal in gleam docs build via documentation.pages Allows Arbitrary File Read and Write CVSS 4.0MEDIUM 4.6
  • TI-2026-71223 Path traversal in Gleam via unvalidated package application names CVSS 4.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences