CVE-2026-103060 erlang CVE debrief

Who should care

Defenders responsible for Erlang and rebar3 deployments should assess exposure and prioritize verification and remediation efforts. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Defenders should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

Defenders should care about CVE-2026-103060 because it allows malicious package publishers to manipulate project file systems through path traversal. This vulnerability affects rebar3 versions from 3.7.0-rc1 before 3.27.2, and its exploitation could lead to directory deletion and file extraction outside intended project directories. Defenders responsible for Erlang and rebar3 deployments should assess exposure, prioritize verification and remediation efforts, and monitor for suspicious dependency fetches.

• Potential directory deletion and file extraction outside intended project directories
• Possible disruption to development workflows and dependency management
• Need for verification of rebar3 versions and dependency management practices
• Potential for malicious package publishers to manipulate project file systems

Technical summary

A path traversal vulnerability in rebar3 allows a malicious package publisher to delete a directory outside the project's _build directory and extract package files into it. This occurs when a developer fetches dependencies using rebar3 get-deps. The vulnerability affects rebar3 versions from 3.7.0-rc1 before 3.27.2. The issue arises from the lack of validation for dependency app names in rebar3, which can lead to directory deletion and file extraction outside intended project directories. Defenders should prioritize verifying rebar3 versions and updating to 3.27.2 or later.

Defensive priority

Defenders should prioritize verifying rebar3 versions and updating to 3.27.2 or later. Inventory checks and monitoring for suspicious dependency fetches are recommended.

Recommended defensive actions

• Verify rebar3 versions and update to 3.27.2 or later
• Conduct inventory checks for vulnerable rebar3 versions
• Monitor for suspicious dependency fetches
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the path traversal vulnerability in rebar3. However, the corpus does not establish versions, exploitation, impact, or remediation beyond vendor-provided information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.