Path traversal in rebar3 via unvalidated dependency app names

{
  "id": "15797f624cec083a91f15551788946d36609cca89d2c19c0b5b931a4ce0f4c5e",
  "url": "https://osv.dev/vulnerability/EEF-CVE-2026-103060",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Path traversal in rebar3 via unvalidated dependency app names",
    "summary": "## Summary Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's `_build` directory and extract package files into it when a developer fetches dependencies. A package release's dependencies in a Hex registry carry an `app` field that names the dependency's OTP application. rebar3 uses this field as the dependency's name without validating it (`rebar_packages:parse_deps/1`) and builds the dependency's directory from that name (`rebar_app_utils:dep_to_app/7`). `rebar_fetch:download_source_online/2` deletes that directory with `rm -rf` and moves the fetched package into it. hex.pm didn't restrict the field to a directory name before 2026-10-12, so a publisher could set it to a value such as `../../../../target`. When a project depends on such a release directly or transitively, `rebar3 get-deps` deletes the directory the name resolves to and writes the dependency's files there. This happens before the dependency's own `rebar.config.script` is evaluated, and `get-deps` compiles nothing. This issue affects rebar3: from 3.7.0-rc1 before 3.27.2. ## Details 1. hex.pm's registry record lists each release's dependencies as maps with `package`, `requirement`, `optional`, `app` and `repository`. The `app` value comes from the publisher's package metadata and hex.pm doesn't restrict it to a directory name. The record is signed with the repository's key a",
    "evidence": "osv:EEF-CVE-2026-103060",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "EEF-CVE-2026-103060",
      "aliases": [
        "CVE-2026-103060",
        "EEF-CVE-2026-103060",
        "GHSA-6ggr-r7mh-2mv8"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/erlang/rebar3",
              "type": "GIT",
              "events": [
                {
                  "introduced": "56b7d88975aa8da6446857cfd92de0825024bf63"
                },
                {
                  "fixed": "e35282b26e499b1d9e8f30bba9dccd71cd8b02ba"
                }
              ]
            }
          ],
          "versions": [
            "3.27.1",
            "3.27.0",
            "3.26.0",
            "3.25.1",
            "3.25.0",
            "3.24.0",
            "3.23.0",
            "3.22.1",
            "3.22.0",
            "3.21.0",
            "3.20.0",
            "3.19.0",
            "3.18.0",
            "3.17.0",
            "3.16.1",
            "3.15.1",
            "3.16.0",
            "3.15.0",
            "3.14.4",
            "3.14.2",
            "3.14.1",
            "3.14.0",
            "3.14.0-rc2",
            "3.14.0-rc1",
            "3.13.0",
            "3.12.0",
            "3.11.1",
            "3.11.0",
            "3.9.1",
            "3.9.0",
            "3.8.0",
            "3.7.5",
            "3.7.4",
            "3.7.3",
            "3.7.2",
            "3.7.1",
            "3.7.0",
            "3.7.0-rc2",
            "3.7.0-rc1"
          ],
          "database_specific": {
            "source": "https://cna.erlef.org/osv/EEF-CVE-2026-103060.json"
          }
        }
      ],
      "modified": "2026-10-12T15:56:09.609223277Z",
      "provider": "osv",
      "references": [
        "https://github.com/erlang/rebar3/security/advisories/GHSA-6ggr-r7mh-2mv8",
        "https://cna.erlef.org/cves/CVE-2026-103060.html",
        "https://github.com/erlang/rebar3/commit/56b7d88975aa8da6446857cfd92de0825024bf63",
        "https://github.com/erlang/rebar3/commit/e35282b26e499b1d9e8f30bba9dccd71cd8b02ba"
      ],
      "provider_metadata": {
        "cpe_ids": [
          "cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*"
        ],
        "cwe_ids": [
          "CWE-22"
        ],
        "capec_ids": [
          "CAPEC-126"
        ]
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-103060",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 300019,
  "published_at": "2026-10-12T15:43:57.636+00:00"
}