Vulnpedia
← Search CVEs

CVE-2026-96612

HIGH 7.5

Published 2026-10-12 · Last modified 2026-10-16

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. A package release's requirements carry an app label that names the dependency's OTP application. Hex takes this label from the repository's signed registry and uses it as the dependency's application name without validating it (Hex.RemoteConverger.deps/2, Hex.Mix.to_lock/1). Mix derives the dependency's checkout directory as deps/<app>, and Hex.SCM.update/1 runs File.rm_rf!/1 on that directory and unpacks the package into it. hex.pm only checks the label's length, so a publisher can set it to a value such as ../../target. When a project depends on such a release directly or transitively, mix deps.get or mix deps.update deletes the directory the label resolves to and writes the labelled package's files there. This happens before any dependency code is compiled. This issue affects hex: from 0.6.0 before 2.5.2.

ELEVATED IMPACT

Severe if exploited (CVSS 7.5), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 38th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

7.5CVSS 4.0 · HIGH

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ⚠User interaction: Requires active user interaction
  • ✓Complexity: No special conditions — reliably repeatable
  • ⚠Requirements: Specific conditions must be present

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Hexpm

Products Hex

Weakness (CWE)

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References and research data (JSON)

Vendor product assessments

Showing 32 of 328 vendor product statements; 296 omitted. Read the full vendor advisory.

  • rhdh/rhdh-must-gather-rhel9 as a component of Red Hat Developer Hub · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/rhdh-must-gather-rhel9?repository_url=registry.redhat.io/rhdh/rhdh-must-gather-rhel9

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • offline-knowledge-portal/rhokp-rhel9 as a component of Red Hat Offline Knowledge Portal · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/rhokp-rhel9?repository_url=registry.redhat.io/offline-knowledge-portal/rhokp-rhel9

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • rabbitmq-server as a component of Red Hat OpenStack Platform 16.2 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/rabbitmq-server

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • rabbitmq-server.src as a component of Red Hat OpenStack Platform 16.2 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/rabbitmq-server?arch=src

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • rabbitmq-server as a component of Red Hat OpenStack Platform 17.1 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/rabbitmq-server

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • rabbitmq-server.src as a component of Red Hat OpenStack Platform 17.1 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/rabbitmq-server?arch=src

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • rhtas/tuffer-rhel9 as a component of Red Hat Trusted Artifact Signer · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/tuffer-rhel9?repository_url=registry.redhat.io/rhtas/tuffer-rhel9

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • rhtas/tuftool-rhel9 as a component of Red Hat Trusted Artifact Signer · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/tuftool-rhel9?repository_url=registry.redhat.io/rhtas/tuftool-rhel9

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • rhtpa/rhtpa-rhel10 as a component of Red Hat Trusted Profile Analyzer · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/rhtpa-rhel10?repository_url=registry.redhat.io/rhtpa/rhtpa-rhel10

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • rhtpa/rhtpa-trustification-service-rhel9 as a component of Red Hat Trusted Profile Analyzer · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/rhtpa-trustification-service-rhel9?repository_url=registry.redhat.io/rhtpa/rhtpa-trustification-service-rhel9

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • ansible-automation-platform/automation-orchestrator-backend-rhel9 as a component of Ansible Automation Orchestrator 2026 · under investigation

    Vendor assessment for this product only.

    pkg:oci/automation-orchestrator-backend-rhel9?repository_url=registry.redhat.io/ansible-automation-platform/automation-orchestrator-backend-rhel9

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • ansible-automation-platform-24/lightspeed-rhel8 as a component of Red Hat Ansible Automation Platform 2 · under investigation

    Vendor assessment for this product only.

    pkg:oci/lightspeed-rhel8?repository_url=registry.redhat.io/ansible-automation-platform-24/lightspeed-rhel8

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • ansible-automation-platform-27/eda-controller-rhel9 as a component of Red Hat Ansible Automation Platform 2 · under investigation

    Vendor assessment for this product only.

    pkg:oci/eda-controller-rhel9?repository_url=registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • discovery/discovery-server-rhel9 as a component of Red Hat Discovery 2 · under investigation

    Vendor assessment for this product only.

    pkg:oci/discovery-server-rhel9?repository_url=registry.redhat.io/discovery/discovery-server-rhel9

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • goose.src as a component of Red Hat Enterprise Linux 10 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/goose?arch=src

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • libwayland-egl as a component of Red Hat Enterprise Linux 10 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/libwayland-egl

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • python3-ldb as a component of Red Hat Enterprise Linux 10 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/python3-ldb

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • rust-lldb as a component of Red Hat Enterprise Linux 10 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/rust-lldb

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • samba-common-libs as a component of Red Hat Enterprise Linux 10 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/samba-common-libs

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • samba-winbind as a component of Red Hat Enterprise Linux 10 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/samba-winbind

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • trustee-kbs as a component of Red Hat Enterprise Linux 10 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/trustee-kbs

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • rls (rust-toolset:rhel8) as a component of Red Hat Enterprise Linux 8 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/rls?rpmmod=rust-toolset:rhel8

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • rust (rust-toolset:rhel8) as a component of Red Hat Enterprise Linux 8 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/rust?rpmmod=rust-toolset:rhel8

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • ctdb as a component of Red Hat Enterprise Linux 9 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/ctdb

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • ldb-tools as a component of Red Hat Enterprise Linux 9 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/ldb-tools

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • python3-ldb as a component of Red Hat Enterprise Linux 9 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/python3-ldb

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • rust-gdb as a component of Red Hat Enterprise Linux 9 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/rust-gdb

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • samba-common-tools as a component of Red Hat Enterprise Linux 9 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/samba-common-tools

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • samba-winbind-clients as a component of Red Hat Enterprise Linux 9 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/samba-winbind-clients

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • openshell.src as a component of Red Hat Hardened Images · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/openshell?arch=src

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • coreos-installer-dracut as a component of Red Hat OpenShift Container Platform 4 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/coreos-installer-dracut

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00
  • satellite/iop-vmaas-rhel9 as a component of Red Hat Satellite 6 · under investigation

    Vendor assessment for this product only.

    pkg:oci/iop-vmaas-rhel9?repository_url=registry.redhat.io/satellite/iop-vmaas-rhel9

    Red Hat · CVE-2026-96612 · Updated 2026-10-20T17:39:15+00:00

All CVSS metrics

  • HIGH 7.5 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • HIGH 7.5 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS