CVE-2026-23939 · published 2026-02-26 · updated 2026-04-07

Path Traversal in Local File Store Backend

MEDIUM 6.9 CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
OSV.dev JSON

Am I affected?

This record states its affected versions in a form that can't be compared automatically.

≥ 931ee0e < 5d2ccd2 affected
every other version: unaffected

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Relative Path Traversal.

This vulnerability is associated with program files lib/hexpm/store/local.ex and program routines 'Elixir.Hexpm.Store.Local':get/3, 'Elixir.Hexpm.Store.Local':put/4, 'Elixir.Hexpm.Store.Local':delete/2, 'Elixir.Hexpm.Store.Local':delete_many/2.

This issue does NOT affect hex.pm the service. Only self-hosted deployments using the Local Storage backend are affected.

This issue affects hexpm: from 931ee0ed46fa89218e0400a4f6e6d15f96406050 before 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0.

Weaknesses & attack patterns

Weakness

CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in catalog → MITRE ↗

Attack patterns

CAPEC-139 · Relative Path Traversal MITRE ↗

Affected — GitHub / hexpm/hexpm Repository ↗

≥ 931ee0e < 5d2ccd2 affected
every other version: unaffected
cpe cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*
modules · source files · routines
modules 'Elixir.Hexpm.Store.Local'
source files lib/hexpm/store/local.ex
routines 'Elixir.Hexpm.Store.Local':get/3 · 'Elixir.Hexpm.Store.Local':put/4 · 'Elixir.Hexpm.Store.Local':delete/2 · 'Elixir.Hexpm.Store.Local':delete_many/2

Workarounds

  • Avoid the local file store backend in any exposed environment.
  • Restrict network access to the registry when using the local backend.
  • Production deployments should use object storage (e.g., S3-compatible backends) instead of the local filesystem store.

Configurations

Only self-hosted hexpm deployments using the Hexpm.Store.Local storage backend are affected. The hex.pm service and deployments using S3-compatible object storage backends are not affected.

References

github.com/hexpm/hexpm · GHSA-42mv-r64p-4869 ↗ vendor-advisory
github.com/hexpm/hexpm · 5d2ccd2 ↗ patch
osv.dev · EEF-CVE-2026-23939 ↗ related

Credits

Michael Lubas / Paraxial.io Finder
Jonatan Männchen / EEF Remediation developer
Eric Meadows-Jönsson / Hex.pm Remediation reviewer

CVSS breakdown

MEDIUM 6.9 open in calculator →
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
« All CVEs