Path Traversal Vulnerability in Erlang Rebar3 Affects Package Management

CVE-2026-103060

What is CVE-2026-103060?

A path traversal vulnerability in Erlang's rebar3 allows malicious package publishers to manipulate directory structures. By exploiting the improper validation of the app field in a package's dependencies, an attacker can set the field to a crafted value such as ../../../../target. This could lead to the unintentional deletion of directories outside the project's _build directory when developers fetch dependencies. As the rebar_fetch function executes, it can remove directories and overwrite them with fetched package files, posing a serious risk to the integrity of project directories. This vulnerability affects versions from 3.7.0-rc1 up to, but not including, 3.27.2.

References