Skip to content
Fencer Vulns
medium 4.6

CVE-2026-32685 json

Path Traversal in gleam docs build via documentation.pages Allows Arbitrary File Read and Write

published 2026-06-02 5 mo ago modified 2026-10-06 33 d ago also EUVD-2026-33927

cvss
4.6
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits
0
none known

Summary

Path traversal vulnerability in Gleam's handling of custom documentation pages allows arbitrary file read and file write outside the intended documentation output directory.

The documentation.pages entries from gleam.toml are incorporated into filesystem paths without sufficient validation or confinement to the intended project and documentation output directories. The documentation.pages[].path field can be used to write generated documentation files outside the intended build/dev/docs/<package>/ output directory. The documentation.pages[].source field can be used to read files outside the project directory and embed their contents into generated documentation output.

An attacker who can convince a victim to run gleam docs build on an untrusted project, or with untrusted gleam.toml content, can cause local files readable by the victim to be included in generated documentation artifacts, and can cause generated documentation files to be written outside the intended docs output directory.

This issue affects Gleam from 1.16.0 until 1.17.0.

Patch / fix

  • Gleam Gleam 1.17.0, v1.17.0-elixir, v1.17.0-elixir-alpine, v1.17.0-elixir-slim, v1.17.0-erlang, v1.17.0-erlang-alpine, v1.17.0-erlang-slim, v1.17.0-node, v1.17.0-node-alpine, v1.17.0-node-slim, v1.17.0-scratch
  • gleam openSUSE Leap 16.0 1.17.0-bp160.1.1
  • gleam openSUSE Tumbleweed 1.17.0-1.1

opensuse advisories openSUSE-SU-2026:21143-1openSUSE-SU-2026:10953-1

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/gleam-lang/gleam/security/advisories/GHSA-wjx8-7w8m-p4v7 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 4.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CNA 4.0 4.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Gleam Gleam

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.