CVE-2026-103061 Path traversal in Gleam via unvalidated package application names

[
  {
    "cpes": [
      "cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "gleam_cli::dependencies",
      "gleam_core::manifest",
      "gleam_core::paths",
      "gleam_core::build::project_compiler",
      "gleam_cli::fs"
    ],
    "packageName": "gleam",
    "packageURL": "pkg:software-id/gleam.run/gleam",
    "product": "Gleam",
    "programFiles": [
      "compiler-cli/src/dependencies.rs",
      "compiler-core/src/manifest.rs",
      "compiler-core/src/paths.rs",
      "compiler-core/src/build/project_compiler.rs",
      "compiler-cli/src/fs.rs"
    ],
    "programRoutines": [
      {
        "name": "gleam_cli::dependencies::hex_manifest_package"
      },
      {
        "name": "gleam_core::manifest::ManifestPackage::application_name"
      },
      {
        "name": "gleam_core::paths::ProjectPaths::build_directory_for_package"
      },
      {
        "name": "gleam_core::build::project_compiler::ProjectCompiler::load_cache_or_compile_package"
      },
      {
        "name": "gleam_cli::fs::delete_directory"
      }
    ],
    "vendor": "Gleam",
    "versions": [
      {
        "lessThan": "1.19.2",
        "status": "affected",
        "version": "0.32.4",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://ghcr.io",
    "cpes": [
      "cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "gleam_cli::dependencies",
      "gleam_core::manifest",
      "gleam_core::paths",
      "gleam_core::build::project_compiler",
      "gleam_cli::fs"
    ],
    "packageName": "gleam-lang/gleam",
    "packageURL": "pkg:oci/gleam?repository_url=ghcr.io%2Fgleam-lang",
    "product": "Gleam",
    "programFiles": [
      "compiler-cli/src/dependencies.rs",
      "compiler-core/src/manifest.rs",
      "compiler-core/src/paths.rs",
      "compiler-core/src/build/project_compiler.rs",
      "compiler-cli/src/fs.rs"
    ],
    "programRoutines": [
      {
        "name": "gleam_cli::dependencies::hex_manifest_package"
      },
      {
        "name": "gleam_core::manifest::ManifestPackage::application_name"
      },
      {
        "name": "gleam_core::paths::ProjectPaths::build_directory_for_package"
      },
      {
        "name": "gleam_core::build::project_compiler::ProjectCompiler::load_cache_or_compile_package"
      },
      {
        "name": "gleam_cli::fs::delete_directory"
      }
    ],
    "vendor": "Gleam",
    "versions": [
      {
        "lessThan": "v1.19.2-elixir",
        "status": "affected",
        "version": "v0.32.4-elixir",
        "versionType": "other"
      },
      {
        "lessThan": "v1.19.2-erlang",
        "status": "affected",
        "version": "v0.32.4-erlang",
        "versionType": "other"
      },
      {
        "lessThan": "v1.19.2-node",
        "status": "affected",
        "version": "v0.32.4-node",
        "versionType": "other"
      },
      {
        "lessThan": "v1.19.2-node-slim",
        "status": "affected",
        "version": "v0.32.4-node-slim",
        "versionType": "other"
      },
      {
        "lessThan": "v1.19.2-elixir-slim",
        "status": "affected",
        "version": "v0.32.4-elixir-slim",
        "versionType": "other"
      },
      {
        "lessThan": "v1.19.2-erlang-slim",
        "status": "affected",
        "version": "v0.32.4-erlang-slim",
        "versionType": "other"
      },
      {
        "lessThan": "v1.19.2-erlang-alpine",
        "status": "affected",
        "version": "v0.32.4-erlang-alpine",
        "versionType": "other"
      },
      {
        "lessThan": "v1.19.2-elixir-alpine",
        "status": "affected",
        "version": "v0.32.4-elixir-alpine",
        "versionType": "other"
      },
      {
        "lessThan": "v1.19.2-node-alpine",
        "status": "affected",
        "version": "v0.32.4-node-alpine",
        "versionType": "other"
      },
      {
        "lessThan": "v1.19.2-scratch",
        "status": "affected",
        "version": "v0.32.4-scratch",
        "versionType": "other"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "gleam_cli::dependencies",
      "gleam_core::manifest",
      "gleam_core::paths",
      "gleam_core::build::project_compiler",
      "gleam_cli::fs"
    ],
    "packageName": "gleam-lang/gleam",
    "packageURL": "pkg:github/gleam-lang/gleam",
    "product": "Gleam",
    "programFiles": [
      "compiler-cli/src/dependencies.rs",
      "compiler-core/src/manifest.rs",
      "compiler-core/src/paths.rs",
      "compiler-core/src/build/project_compiler.rs",
      "compiler-cli/src/fs.rs"
    ],
    "programRoutines": [
      {
        "name": "gleam_cli::dependencies::hex_manifest_package"
      },
      {
        "name": "gleam_core::manifest::ManifestPackage::application_name"
      },
      {
        "name": "gleam_core::paths::ProjectPaths::build_directory_for_package"
      },
      {
        "name": "gleam_core::build::project_compiler::ProjectCompiler::load_cache_or_compile_package"
      },
      {
        "name": "gleam_cli::fs::delete_directory"
      }
    ],
    "repo": "https://github.com/gleam-lang/gleam",
    "vendor": "Gleam",
    "versions": [
      {
        "changes": [
          {
            "at": "d15c981fac6e533d70ac8ee89a6ef4dbf139adc3",
            "status": "unaffected"
          },
          {
            "at": "54bbb2b98af1505b6eed93c45b1936fc76412e5c",
            "status": "unaffected"
          }
        ],
        "lessThan": "*",
        "status": "affected",
        "version": "d13f27ee80aae7a521d2e9433c4deaf53f892574",
        "versionType": "git"
      }
    ]
  }
]