CVE-2026-23939

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23939", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-01-19T14:23:14.343Z", "datePublished": "2026-02-26T19:41:18.762Z", "dateUpdated": "2026-09-16T15:36:19.353Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Hexpm.Store.Local'"], "packageName": "hexpm/hexpm", "packageURL": "pkg:github/hexpm/hexpm", "product": "hexpm", "programFiles": ["lib/hexpm/store/local.ex"], "programRoutines": [{"name": "'Elixir.Hexpm.Store.Local':get/3"}, {"name": "'Elixir.Hexpm.Store.Local':put/4"}, {"name": "'Elixir.Hexpm.Store.Local':delete/2"}, {"name": "'Elixir.Hexpm.Store.Local':delete_many/2"}], "repo": "https://github.com/hexpm/hexpm.git", "vendor": "hexpm", "versions": [{"lessThan": "5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0", "status": "affected", "version": "931ee0ed46fa89218e0400a4f6e6d15f96406050", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Only self-hosted hexpm deployments using the <tt>Hexpm.Store.Local</tt> storage backend are affected. The hex.pm service and deployments using S3-compatible object storage backends are not affected."}], "value": "Only self-hosted hexpm deployments using the Hexpm.Store.Local storage backend are affected. The hex.pm service and deployments using S3-compatible object storage backends are not affected."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*", "versionEndExcluding": "5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0", "versionStartIncluding": "931ee0ed46fa89218e0400a4f6e6d15f96406050", "vulnerable": true}], "negate": false, "operator": "AND"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Michael Lubas / Paraxial.io"}, {"lang": "en", "type": "remediation developer", "value": "Jonatan M\u00e4nnchen / EEF"}, {"lang": "en", "type": "remediation reviewer", "value": "Eric Meadows-J\u00f6nsson / Hex.pm"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Relative Path Traversal.<p>This vulnerability is associated with program files <tt>lib/hexpm/store/local.ex</tt> and program routines <tt>'Elixir.Hexpm.Store.Local':get/3</tt>, <tt>'Elixir.Hexpm.Store.Local':put/4</tt>, <tt>'Elixir.Hexpm.Store.Local':delete/2</tt>, <tt>'Elixir.Hexpm.Store.Local':delete_many/2</tt>.</p><p>This issue does NOT affect hex.pm the service. Only self-hosted deployments using the Local Storage backend are affected.</p><p>This issue affects hexpm: from 931ee0ed46fa89218e0400a4f6e6d15f96406050 before 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0.</p>"}], "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Relative Path Traversal. This vulnerability is associated with program files lib/hexpm/store/local.ex and program routines 'Elixir.Hexpm.Store.Local':get/3, 'Elixir.Hexpm.Store.Local':put/4, 'Elixir.Hexpm.Store.Local':delete/2, 'Elixir.Hexpm.Store.Local':delete_many/2.\n\nThis issue does NOT affect hex.pm the service. Only self-hosted deployments using the Local Storage backend are affected.\n\nThis issue affects hexpm: from 931ee0ed46fa89218e0400a4f6e6d15f96406050 before 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0."}], "impacts": [{"capecId": "CAPEC-139", "descriptions": [{"lang": "en", "value": "CAPEC-139 Relative Path Traversal"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-16T15:36:19.353Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/hexpm/hexpm/security/advisories/GHSA-42mv-r64p-4869"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-23939.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-23939"}, {"tags": ["patch"], "url": "https://github.com/hexpm/hexpm/commit/5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0"}], "source": {"discovery": "INTERNAL"}, "title": "Path Traversal in Local File Store Backend", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<ul><li>Avoid the local file store backend in any exposed environment.</li><li>Restrict network access to the registry when using the local backend.</li><li>Production deployments should use object storage (e.g., S3-compatible backends) instead of the local filesystem store.</li></ul>"}], "value": "* Avoid the local file store backend in any exposed environment.\n* Restrict network access to the registry when using the local backend.\n* Production deployments should use object storage (e.g., S3-compatible backends) instead of the local filesystem store."}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T20:24:13.786958Z", "id": "CVE-2026-23939", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T20:24:24.772Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23939", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T20:24:13.786958Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T20:24:20.054Z"}}], "cna": {"title": "Path Traversal in Local File Store Backend", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Michael Lubas / Paraxial.io"}, {"lang": "en", "type": "remediation developer", "value": "Jonatan M\u00e4nnchen / EEF"}, {"lang": "en", "type": "remediation reviewer", "value": "Eric Meadows-J\u00f6nsson / Hex.pm"}], "impacts": [{"capecId": "CAPEC-139", "descriptions": [{"lang": "en", "value": "CAPEC-139 Relative Path Traversal"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*"], "repo": "https://github.com/hexpm/hexpm.git", "vendor": "hexpm", "modules": ["'Elixir.Hexpm.Store.Local'"], "product": "hexpm", "versions": [{"status": "affected", "version": "931ee0ed46fa89218e0400a4f6e6d15f96406050", "lessThan": "5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0", "versionType": "git"}], "packageURL": "pkg:github/hexpm/hexpm", "packageName": "hexpm/hexpm", "programFiles": ["lib/hexpm/store/local.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Hexpm.Store.Local':get/3"}, {"name": "'Elixir.Hexpm.Store.Local':put/4"}, {"name": "'Elixir.Hexpm.Store.Local':delete/2"}, {"name": "'Elixir.Hexpm.Store.Local':delete_many/2"}]}], "references": [{"url": "https://github.com/hexpm/hexpm/security/advisories/GHSA-42mv-r64p-4869", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-23939.html", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-23939", "tags": ["related"]}, {"url": "https://github.com/hexpm/hexpm/commit/5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "* Avoid the local file store backend in any exposed environment.\n* Restrict network access to the registry when using the local backend.\n* Production deployments should use object storage (e.g., S3-compatible backends) instead of the local filesystem store.", "supportingMedia": [{"type": "text/html", "value": "<ul><li>Avoid the local file store backend in any exposed environment.</li><li>Restrict network access to the registry when using the local backend.</li><li>Production deployments should use object storage (e.g., S3-compatible backends) instead of the local filesystem store.</li></ul>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Relative Path Traversal. This vulnerability is associated with program files lib/hexpm/store/local.ex and program routines 'Elixir.Hexpm.Store.Local':get/3, 'Elixir.Hexpm.Store.Local':put/4, 'Elixir.Hexpm.Store.Local':delete/2, 'Elixir.Hexpm.Store.Local':delete_many/2.\n\nThis issue does NOT affect hex.pm the service. Only self-hosted deployments using the Local Storage backend are affected.\n\nThis issue affects hexpm: from 931ee0ed46fa89218e0400a4f6e6d15f96406050 before 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0.", "supportingMedia": [{"type": "text/html", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Relative Path Traversal.<p>This vulnerability is associated with program files <tt>lib/hexpm/store/local.ex</tt> and program routines <tt>'Elixir.Hexpm.Store.Local':get/3</tt>, <tt>'Elixir.Hexpm.Store.Local':put/4</tt>, <tt>'Elixir.Hexpm.Store.Local':delete/2</tt>, <tt>'Elixir.Hexpm.Store.Local':delete_many/2</tt>.</p><p>This issue does NOT affect hex.pm the service. Only self-hosted deployments using the Local Storage backend are affected.</p><p>This issue affects hexpm: from 931ee0ed46fa89218e0400a4f6e6d15f96406050 before 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "configurations": [{"lang": "en", "value": "Only self-hosted hexpm deployments using the Hexpm.Store.Local storage backend are affected. The hex.pm service and deployments using S3-compatible object storage backends are not affected.", "supportingMedia": [{"type": "text/html", "value": "Only self-hosted hexpm deployments using the <tt>Hexpm.Store.Local</tt> storage backend are affected. The hex.pm service and deployments using S3-compatible object storage backends are not affected.", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0", "versionStartIncluding": "931ee0ed46fa89218e0400a4f6e6d15f96406050"}], "operator": "AND"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-16T15:36:19.353Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23939", "state": "PUBLISHED", "dateUpdated": "2026-09-16T15:36:19.353Z", "dateReserved": "2026-01-19T14:23:14.343Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-02-26T19:41:18.762Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Hexpm.Store.Local'"], "packageName": "hexpm/hexpm", "packageURL": "pkg:github/hexpm/hexpm", "product": "hexpm", "programFiles": ["lib/hexpm/store/local.ex"], "programRoutines": [{"name": "'Elixir.Hexpm.Store.Local':get/3"}, {"name": "'Elixir.Hexpm.Store.Local':put/4"}, {"name": "'Elixir.Hexpm.Store.Local':delete/2"}, {"name": "'Elixir.Hexpm.Store.Local':delete_many/2"}], "repo": "https://github.com/hexpm/hexpm.git", "vendor": "hexpm", "versions": [{"lessThan": "5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0", "status": "affected", "version": "931ee0ed46fa89218e0400a4f6e6d15f96406050", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hex:hexpm:*:*:*:*:*:*:*:*", "matchCriteriaId": "DCABE381-093D-4100-A8AB-0660BBF3F8E1", "versionEndExcluding": "2026-02-26", "versionStartIncluding": "2014-09-29", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Relative Path Traversal. This vulnerability is associated with program files lib/hexpm/store/local.ex and program routines 'Elixir.Hexpm.Store.Local':get/3, 'Elixir.Hexpm.Store.Local':put/4, 'Elixir.Hexpm.Store.Local':delete/2, 'Elixir.Hexpm.Store.Local':delete_many/2.\n\nThis issue does NOT affect hex.pm the service. Only self-hosted deployments using the Local Storage backend are affected.\n\nThis issue affects hexpm: from 931ee0ed46fa89218e0400a4f6e6d15f96406050 before 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0."}, {"lang": "es", "value": "Vulnerabilidad de Limitaci\u00f3n Inadecuada de un Nombre de Ruta a un Directorio Restringido ('Salto de Ruta') en hexpm hexpm/hexpm (m\u00f3dulo 'Elixir.Hexpm.Store.Local') permite Salto de Ruta Relativo. Esta vulnerabilidad est\u00e1 asociada con los archivos de programa lib/hexpm/store/local.ex y las rutinas de programa 'Elixir.Hexpm.Store.Local':get/3, 'Elixir.Hexpm.Store.Local':put/4, 'Elixir.Hexpm.Store.Local':delete/2, 'Elixir.Hexpm.Store.Local':delete_many/2.\n\nEste problema NO afecta a hex.pm el servicio. Solo las implementaciones autoalojadas que utilizan el backend de Almacenamiento Local se ven afectadas.\n\nEste problema afecta a hexpm: desde 931ee0ed46fa89218e0400a4f6e6d15f96406050 antes de 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0."}], "id": "CVE-2026-23939", "lastModified": "2026-06-17T10:22:18.973", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23939", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T20:24:13.786958Z", "version": "2.0.3"}}]}, "published": "2026-02-26T20:31:35.763", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-23939.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/hexpm/hexpm/commit/5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/hexpm/hexpm/security/advisories/GHSA-42mv-r64p-4869"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-23939"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[931ee0ed46fa89218e0400a4f6e6d15f96406050,5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[pkg:github/hexpm/hexpm@931ee0ed46fa89218e0400a4f6e6d15f96406050,pkg:github/hexpm/hexpm@5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "hexpm", "source": "cna", "vendor": "hexpm"}, "product": "hexpm", "vendor": "hexpm"}], "analysis": {"en": {"generated_at": "2026-04-15T23:53:04.177805+00:00", "value": {"mitigation_remediation": ["Update Hexpm to a version released after commit 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0", "Replace the local filesystem backend with an object storage backend (e.g., S3 or S3\u2011compatible services) for artifact storage", "If a backend change is not immediately feasible, restrict network exposure of the registry and isolate the local file store from external access"], "summary": {"action": "Immediate Patch", "impact": "Unrestricted file access through local file store"}, "threat_synthesis": {"affected_systems": "Self\u2011hosted Hexpm installations that use the local filesystem backend for package storage. The vulnerability affects hexpm versions from commit 931ee0ed46fa89218e0400a4f6e6d15f96406050 up to, but not including, commit 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0. Hex.pm\u2019s hosted service is not affected.", "description_and_impact": "An improper limitation of pathname validation in the local file store backend of self\u2011hosted Hexpm allows relative path traversal. This vulnerability, stemming from CWE\u201122, can enable an attacker to access or modify files outside the designated storage directory by exploiting the get/put/delete operations in the Local Store module. The exposed ability to read or overwrite arbitrary files can compromise sensitive data or disrupt the registry's operation.\n\nThis flaw affects Hexpm installations that use the local filesystem backend for package storage. The vulnerability is present in all releases prior to commit 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0, covering versions identified by the hash 931ee0ed46fa89218e0400a4f6e6d15f96406050 and earlier.\n\nThe risk assessment shows a CVSS score of 6.9 and an EPSS of less than 1\u202f%, indicating moderate severity with a low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. An attacker would most likely leverage any publicly exposed API or service that performs local store operations, potentially in a managed or shared hosting environment. Mitigation requires applying the fix or altering the deployment configuration to prevent such access.", "risk_and_exploitability": "The CVSS score of 6.9 reflects a moderate impact with potential integrity breach of the registry\u2019s file system. EPSS indicates a very low exploitation likelihood (<\u202f1\u202f%), and the vulnerability is not in CISA\u2019s KEV catalog. Likely attackers would attempt path traversal via the exposed local store API endpoints (get, put, delete), especially if the registry is publicly reachable or shared. In environments where the local backend is isolated or the network is restricted, the risk remains low, but any exposed instance can allow unauthorized file access or modification."}}}}, "created": "2026-02-27T09:07:05.610020+00:00", "updated": "2026-04-16T00:00:14.146661+00:00", "vendors": ["hexpm", "hexpm$PRODUCT$hexpm"]}