Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Use of Incorrectly-Resolved Name or Reference CWE-706 CWE-706 at MITRE
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
CVEs
CVEs for Use of Incorrectly-Resolved Name or Reference CWE-706
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| httpd mod_auth directory protection bypassed by a doubled slash in the request path |
Erlang
pkg:otp/inets
|
CVE-2026-66835 | 2026-09-01 |
| httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems |
Erlang
pkg:otp/inets
|
CVE-2026-73270 | 2026-09-01 |
| AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant | CVE-2026-82726 | 2026-08-31 | |
| Path traversal in AshAdmin file uploads via unsanitized client filename | CVE-2026-82673 | 2026-08-31 | |
| Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download |
ghcr.io / livebook-dev/livebook
|
CVE-2026-66881 | 2026-08-05 |
| Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup | CVE-2026-66883 | 2026-08-04 | |
| Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass |
Erlang / stdlib
|
CVE-2026-47078 | 2026-07-27 |
| Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects | CVE-2026-48595 | 2026-06-02 | |
| Symlink Following in Hex Package Export Allows Embedding Files Outside Project Root |
Gleam
ghcr.io / gleam-lang/gleam
|
CVE-2026-42795 | 2026-06-02 |
| Path Traversal in gleam docs build via documentation.pages Allows Arbitrary File Read and Write |
Gleam
ghcr.io / gleam-lang/gleam
|
CVE-2026-32685 | 2026-06-02 |
| Path Traversal in build/packages/packages.toml Allows Arbitrary Directory Deletion |
Gleam
ghcr.io / gleam-lang/gleam
|
CVE-2026-43965 | 2026-06-02 |
| SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT |
Erlang / ssh
|
CVE-2026-32147 | 2026-04-21 |
| Improper Path Validation in Git Dependency Handling Allows Arbitrary File System Modification |
Gleam
ghcr.io / gleam-lang/gleam
|
CVE-2026-32146 | 2026-04-11 |
| SFTP root escape via component-agnostic prefix check in ssh_sftpd |
Erlang / ssh
|
CVE-2026-23942 | 2026-03-13 |
| Path Traversal in wisp.serve_static allows arbitrary file read | CVE-2026-28807 | 2026-03-10 | |
| Path Traversal in Local File Store Backend | CVE-2026-23939 | 2026-02-26 | |
| TFTP Path Traversal |
Erlang / inets
Erlang / tftp
|
CVE-2026-21620 | 2026-02-20 |
| Absolute path traversal in zip:unzip/1,2 |
Erlang / stdlib
|
CVE-2025-4748 | 2025-06-16 |