---
id: CVE-2026-23939
title: Path Traversal in Local File Store Backend
summary: >-
  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows
  Relative Path Traversal. This vulnerability is associated with program files
  lib…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: hexpm
product: hexpm/hexpm
affected:
  - >-
    hexpm/hexpm >= 931ee0ed46fa89218e0400a4f6e6d15f96406050 <
    5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-02-26T20:24:13.786958Z'
published: '2026-02-26'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T15:36:19.353Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23939'
references:
  - url: 'https://github.com/hexpm/hexpm/security/advisories/GHSA-42mv-r64p-4869'
  - url: 'https://cna.erlef.org/cves/CVE-2026-23939.html'
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-23939'
  - url: >-
      https://github.com/hexpm/hexpm/commit/5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0
tags:
  - cve.org
epss: 0.00425
epssPercentile: 0.34134
ingestedAt: '2026-09-16T15:58:38.773Z'
---

## Overview

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Relative Path Traversal. This vulnerability is associated with program files lib/hexpm/store/local.ex and program routines 'Elixir.Hexpm.Store.Local':get/3, 'Elixir.Hexpm.Store.Local':put/4, 'Elixir.Hexpm.Store.Local':delete/2, 'Elixir.Hexpm.Store.Local':delete_many/2.

This issue does NOT affect hex.pm the service. Only self-hosted deployments using the Local Storage backend are affected.

This issue affects hexpm: from 931ee0ed46fa89218e0400a4f6e6d15f96406050 before 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0.

## Affected

- `hexpm/hexpm >= 931ee0ed46fa89218e0400a4f6e6d15f96406050 < 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

* Avoid the local file store backend in any exposed environment.
* Restrict network access to the registry when using the local backend.
* Production deployments should use object storage (e.g., S3-compatible backends) instead of the local filesystem store.