CVE-2026-103060

Name of the Vulnerable Software and Affected Versions erlang rebar3 versions 3.7.0-rc1 through 3.27.1

Description A path traversal issue exists where a malicious package publisher can delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. This occurs because rebar3 uses the app field from a Hex registry dependency to name the dependency without validation. Specifically, the rebar packages:parse deps/1 function assigns the name, and rebar app utils:dep to app/7 builds the directory path. Subsequently, rebar fetch:download source online/2 deletes the resolved directory using rm -rf and moves the fetched package into it. If a publisher sets the app field to a value containing path traversal sequences like ../../../../target, rebar3 will delete and overwrite the directory that the path resolves to. This process happens before the dependency's rebar.config.script is evaluated. Replacing a directory whose contents are later executed or loaded can lead to remote code execution.

Recommendations Upgrade rebar3 to version 3.27.2 or later.