CVE-2026-23939 Path Traversal in Local File Store Backend

[
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.Hexpm.Store.Local'"
    ],
    "packageName": "hexpm/hexpm",
    "packageURL": "pkg:github/hexpm/hexpm",
    "product": "hexpm",
    "programFiles": [
      "lib/hexpm/store/local.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.Hexpm.Store.Local':get/3"
      },
      {
        "name": "'Elixir.Hexpm.Store.Local':put/4"
      },
      {
        "name": "'Elixir.Hexpm.Store.Local':delete/2"
      },
      {
        "name": "'Elixir.Hexpm.Store.Local':delete_many/2"
      }
    ],
    "repo": "https://github.com/hexpm/hexpm.git",
    "vendor": "hexpm",
    "versions": [
      {
        "lessThan": "5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0",
        "status": "affected",
        "version": "931ee0ed46fa89218e0400a4f6e6d15f96406050",
        "versionType": "git"
      }
    ]
  }
]