{"id":"CVE-2026-23939","title":"Path Traversal in Local File Store Backend","summary":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Relative Path Traversal. This vulnerability is associated with program files lib…","severity":"medium","cvss":6.9,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-22"],"vendor":"hexpm","product":"hexpm/hexpm","affected":["hexpm/hexpm >= 931ee0ed46fa89218e0400a4f6e6d15f96406050 < 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-02-26T20:24:13.786958Z"},"published":"2026-02-26","updated":"2026-09-16","sourceUpdated":"2026-09-16T15:36:19.353Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23939","references":[{"url":"https://github.com/hexpm/hexpm/security/advisories/GHSA-42mv-r64p-4869"},{"url":"https://cna.erlef.org/cves/CVE-2026-23939.html"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-23939"},{"url":"https://github.com/hexpm/hexpm/commit/5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0"}],"tags":["cve.org"],"epss":0.00409,"epssPercentile":0.34898,"ingestedAt":"2026-09-16T15:58:38.773Z","slug":"CVE-2026-23939","body":"## Overview\n\nImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Relative Path Traversal. This vulnerability is associated with program files lib/hexpm/store/local.ex and program routines 'Elixir.Hexpm.Store.Local':get/3, 'Elixir.Hexpm.Store.Local':put/4, 'Elixir.Hexpm.Store.Local':delete/2, 'Elixir.Hexpm.Store.Local':delete_many/2.\n\nThis issue does NOT affect hex.pm the service. Only self-hosted deployments using the Local Storage backend are affected.\n\nThis issue affects hexpm: from 931ee0ed46fa89218e0400a4f6e6d15f96406050 before 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0.\n\n## Affected\n\n- `hexpm/hexpm >= 931ee0ed46fa89218e0400a4f6e6d15f96406050 < 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\n* Avoid the local file store backend in any exposed environment.\n* Restrict network access to the registry when using the local backend.\n* Production deployments should use object storage (e.g., S3-compatible backends) instead of the local filesystem store.","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":38,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}