Path Traversal Vulnerability in Gleam Documentation Handling

CVE-2026-32685

What is CVE-2026-32685?

A path traversal vulnerability exists in Gleam's custom documentation pages management, enabling unauthorized file read and write operations. The issue arises from insufficient validation in the incorporation of documentation.pages entries from gleam.toml into filesystem paths. Attackers can exploit this flaw by persuading users to run the 'gleam docs build' command on untrusted projects or with untrusted gleam.toml content, potentially leading to the inclusion of sensitive local files in generated documentation. This can allow harmful files to be written outside the designated output directory, posing significant security risks.

References