Path Traversal Vulnerability in Hexpm Product by Hexpm Vendor

CVE-2026-23939

What is CVE-2026-23939?

A vulnerability exists in the Hexpm product, specifically in the Elixir.Hexpm.Store.Local module, which permits relative path traversal. This can lead to unauthorized access to files and directories outside of the intended storage scope. Affected are self-hosted installations using the Local Storage backend. This issue is not present in the hosted service at hex.pm. Key program files and routines including lib/hexpm/store/local.ex and related methods such as 'get/3', 'put/4', 'delete/2', and 'delete_many/2' are implicated. Users of Hexpm are advised to evaluate their deployment and apply the necessary updates.

References