CVE-2026-23939

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23939
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Relative Path Traversal. This vulnerability is associated with program files lib/hexpm/store/local.ex and program routines 'Elixir.Hexpm.Store.Local':get/3, 'Elixir.Hexpm.Store.Local':put/4, 'Elixir.Hexpm.Store.Local':delete/2, 'Elixir.Hexpm.Store.Local':delete_many/2. This issue does NOT affect hex.pm the service. Only self-hosted deployments using the Local Storage backend are affected. This issue affects hexpm: from 931ee0ed46fa89218e0400a4f6e6d15f96406050 before 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cna.erlef.org/cves/CVE-2026-23939.html
https://github.com/hexpm/hexpm/commit/5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0 Patch
https://github.com/hexpm/hexpm/security/advisories/GHSA-42mv-r64p-4869 Mitigation Vendor Advisory
https://osv.dev/vulnerability/EEF-CVE-2026-23939
Configurations

Configuration 1 (hide)

cpe:2.3:a:hex:hexpm:*:*:*:*:*:*:*:*
History

06 Apr 2026, 17:17

Type Values Removed Values Added
References
  • () https://cna.erlef.org/cves/CVE-2026-23939.html -
  • () https://osv.dev/vulnerability/EEF-CVE-2026-23939 -

23 Mar 2026, 17:12

Type Values Removed Values Added
CPE cpe:2.3:a:hex:hexpm:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
First Time Hex
Hex hexpm
References () https://github.com/hexpm/hexpm/commit/5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0 - () https://github.com/hexpm/hexpm/commit/5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0 - Patch
References () https://github.com/hexpm/hexpm/security/advisories/GHSA-42mv-r64p-4869 - () https://github.com/hexpm/hexpm/security/advisories/GHSA-42mv-r64p-4869 - Mitigation, Vendor Advisory

27 Feb 2026, 14:06

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de Limitación Inadecuada de un Nombre de Ruta a un Directorio Restringido ('Salto de Ruta') en hexpm hexpm/hexpm (módulo 'Elixir.Hexpm.Store.Local') permite Salto de Ruta Relativo. Esta vulnerabilidad está asociada con los archivos de programa lib/hexpm/store/local.ex y las rutinas de programa 'Elixir.Hexpm.Store.Local':get/3, 'Elixir.Hexpm.Store.Local':put/4, 'Elixir.Hexpm.Store.Local':delete/2, 'Elixir.Hexpm.Store.Local':delete_many/2. Este problema NO afecta a hex.pm el servicio. Solo las implementaciones autoalojadas que utilizan el backend de Almacenamiento Local se ven afectadas. Este problema afecta a hexpm: desde 931ee0ed46fa89218e0400a4f6e6d15f96406050 antes de 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0.

26 Feb 2026, 20:31

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-26 20:31

Updated : 2026-04-06 17:17

NVD link : CVE-2026-23939

Mitre link : CVE-2026-23939

CVE.ORG link : CVE-2026-23939

JSON object : View

Products Affected

hex

  • hexpm
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')