Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-23939

Path Traversal in Local File Store Backend

CVSS 4.0 6.9 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-23939

Published

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Relative Path Traversal. This vulnerability is associated with program files lib/hexpm/store/local.ex and program routines 'Elixir.Hexpm.Store.Local':get/3, 'Elixir.Hexpm.Store.Local':put/4, 'Elixir.Hexpm.Store.Local':delete/2, 'Elixir.Hexpm.Store.Local':delete_many/2. This issue does NOT affect hex.pm the service. Only self-hosted deployments using the Local Storage backend are affected. This issue affects hexpm: from 931ee0ed46fa89218e0400a4f6e6d15f96406050 before 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-23939

Published

hexpm/hexpm

https://github.com

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "collectionURL": "https://github.com",
                    "cpes": [
                        "cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "'Elixir.Hexpm.Store.Local'"
                    ],
                    "packageName": "hexpm/hexpm",
                    "packageURL": "pkg:github/hexpm/hexpm",
                    "product": "hexpm",
                    "programFiles": [
                        "lib/hexpm/store/local.ex"
                    ],
                    "programRoutines": [
                        {
                            "name": "'Elixir.Hexpm.Store.Local':get/3"
                        },
                        {
                            "name": "'Elixir.Hexpm.Store.Local':put/4"
                        },
                        {
                            "name": "'Elixir.Hexpm.Store.Local':delete/2"
                        },
                        {
                            "name": "'Elixir.Hexpm.Store.Local':delete_many/2"
                        }
                    ],
                    "repo": "https://github.com/hexpm/hexpm.git",
                    "vendor": "hexpm",
                    "versions": [
                        {
                            "lessThan": "5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0",
                            "status": "affected",
                            "version": "931ee0ed46fa89218e0400a4f6e6d15f96406050",
                            "versionType": "git"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON