{
  "cveId": "CVE-2026-96612",
  "url": "https://patchblox.com/security/cve/CVE-2026-96612",
  "summary": "CVE-2026-96612 is fixed in erlang-hex on 1 platform by DEBIAN-CVE-2026-96612 (version 2.5.3-2), released October 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "erlang-hex: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in hexpm hex allows a ma...",
  "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project\u0027s deps directory and extract package files into it when a developer fetches dependencies.  A package release\u0027s requirements carry an app label that names the dependency\u0027s OTP application. Hex takes this label from the repository\u0027s signed registry and uses it as the dependency\u0027s application name without validating it (Hex.RemoteConverger.deps/2, Hex.Mix.to_lock/1). Mix derives the dependency\u0027s checkout directory as deps/\u003Capp\u003E, and Hex.SCM.update/1 runs File.rm_rf!/1 on that directory and unpacks the package into it. hex.pm only checks the label\u0027s length, so a publisher can set it to a value such as ../../target. When a project depends on such a release directly or transitively, mix deps.get or mix deps.update deletes the directory the label resolves to and writes the labelled package\u0027s files there. This happens before any dependency code is compiled.  This issue affects hex: from 0.6.0 before 2.5.2.",
  "published": "2026-10-12T16:17:07Z",
  "severity": "",
  "epss": 0.00443,
  "epssPercentile": 0.38801,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "erlang-hex",
      "release": "Debian 14",
      "fixedVersion": "2.5.3-2",
      "fix": "DEBIAN-CVE-2026-96612",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-96612",
      "released": "2026-10-24T13:25:57Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T19:38:12Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}