CVE-2026-103060: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in erlang rebar3

The vulnerability arises from improper validation of the 'app' field in package dependencies fetched from the Hex registry. rebar3 uses this field directly to name dependency directories without sanitization, leading to potential path traversal. A malicious package can specify a path like '../../../../target', causing rebar3 to delete and overwrite directories outside the _build directory during dependency fetching. This happens before any dependency scripts are executed, enabling directory deletion and file placement outside intended boundaries. The flaw affects rebar3 versions >=3.7.0-rc1 and <3.27.2.

An attacker publishing a malicious package can cause rebar3 to delete arbitrary directories outside the project's build directory and place files there when a developer fetches dependencies. This can lead to loss of data or overwriting important files on the developer's system. The vulnerability requires user interaction (fetching dependencies) and does not require privileges. It has a high severity with a CVSS 4.0 score of 7.5, indicating significant impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid fetching dependencies from untrusted sources until an official fix is released. Monitor the erlang/rebar3 project for updates and apply official patches once available. Avoid using affected versions (>=3.7.0-rc1 <3.27.2) in sensitive environments until patched.