Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project’s _build directory and extract package files into it when a developer fetches dependencies.<\/p>\n
A package release’s dependencies in a Hex registry carry an app field that names the dependency’s OTP application. rebar3 uses this field as the dependency’s name without validating it (rebar_packages:parse_deps\/1) and builds the dependency’s directory from that name (rebar_app_utils:dep_to_app\/7). rebar_fetch:download_source_online\/2 deletes that directory with rm -rf and moves the fetched package into it. hex.pm didn’t restrict the field to a directory name before 2026-10-12, so a publisher could set it to a value such as ..\/..\/..\/..\/target. When a project depends on such a release directly or transitively, rebar3 get-deps deletes the directory the name resolves to and writes the dependency’s files there. This happens before the dependency’s own rebar.config.script is evaluated, and get-deps compiles nothing.<\/p>\n
This issue affects rebar3: from 3.7.0-rc1 before 3.27.2.<\/p>\n","protected":false},"excerpt":{"rendered":"
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project’s _build di<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-36074","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/36074","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=36074"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=36074"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=36074"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}