CVE-2026-103060
Description
A flaw was found in rebar3. This vulnerability allows a remote attacker or malicious package publisher to delete arbitrary directories and extract package files into unintended locations outside the project build directory. By supplying a manipulated dependency name containing directory traversal sequences, the flaw is triggered whenever a developer or automated build process fetches project dependencies.
Statement
A flaw rated IMPORTANT by Red Hat was found in rebar3, the Erlang/OTP build tool. rebar3 uses the publisher-controlled app field of a Hex registry package dependency as the dependency's directory name without validating it. A malicious package publisher can set this field to a value containing directory traversal sequences (such as ../../../../target), so that when a developer or automated build process runs rebar3 get-deps on a project that depends on such a release directly or transitively, rebar3 deletes the directory the crafted name resolves to with rm -rf and extracts the attacker-supplied package files into that location outside the project's _build directory. The delete-and-overwrite occurs before the dependency's own scripts are evaluated and requires no compilation or plugin execution; replacing a directory whose contents are later run or loaded can lead to code execution, and the impact on confidentiality, integrity, and availability is confined to the user account executing rebar3. Red Hat's CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects that rebar3 is a local command-line build tool whose exploitation requires user interaction, whereas the upstream CVSS v4 score of 7.5 uses a network attack vector; the difference is one of vector scoring, not overall severity. No Red Hat products are currently listed as affected by this flaw.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream advisory states the issue is fixed in rebar3 3.27.2, so upgrading rebar3 to a release that includes the upstream fix is the recommended way to address this issue. As a general precaution, review dependencies fetched from Hex repositories and run builds under accounts with minimal privileges.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.
Integrity
Technical Impact: Modify Files or Directories
The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending a new account at the end of a password file may allow an attacker to bypass authentication.
Confidentiality
Technical Impact: Read Files or Directories
The attacker may be able to read the contents of unexpected files and expose sensitive data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, by reading a password file, the attacker could conduct brute force password guessing attacks in order to break into an account on the system.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
The attacker may be able to overwrite, delete, or corrupt unexpected critical files such as programs, libraries, or important data. This may prevent the product from working at all and in the case of protection mechanisms such as authentication, it has the potential to lock out product users.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
