CVE-2026-32685 Path Traversal in gleam docs build via documentation.pages Allows Arbitrary File Read and Write

[
  {
    "cpes": [
      "cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "compiler-core",
      "compiler-cli"
    ],
    "packageName": "gleam",
    "packageURL": "pkg:sid/gleam.run/gleam",
    "product": "Gleam",
    "programFiles": [
      "compiler-core/src/config.rs",
      "compiler-core/src/docs.rs",
      "compiler-cli/src/docs.rs",
      "compiler-cli/src/fs.rs"
    ],
    "programRoutines": [
      {
        "name": "compiler_cli::docs::build_project"
      },
      {
        "name": "compiler_core::docs::generate_html"
      }
    ],
    "vendor": "Gleam",
    "versions": [
      {
        "lessThan": "1.17.0",
        "status": "affected",
        "version": "1.16.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "compiler-core",
      "compiler-cli"
    ],
    "packageName": "gleam-lang/gleam",
    "packageURL": "pkg:github/gleam-lang/gleam",
    "product": "Gleam",
    "programFiles": [
      "compiler-core/src/config.rs",
      "compiler-core/src/docs.rs",
      "compiler-cli/src/docs.rs",
      "compiler-cli/src/fs.rs"
    ],
    "programRoutines": [
      {
        "name": "compiler_cli::docs::build_project"
      },
      {
        "name": "compiler_core::docs::generate_html"
      }
    ],
    "repo": "https://github.com/gleam-lang/gleam",
    "vendor": "Gleam",
    "versions": [
      {
        "lessThan": "1.17.0",
        "status": "affected",
        "version": "1.16.0",
        "versionType": "semver"
      },
      {
        "lessThan": "81570611906b6b0039c948037094d09a68700f3a",
        "status": "affected",
        "version": "61ed8deb6572b5591ad17d6302c1a38607522f16",
        "versionType": "git"
      }
    ]
  },
  {
    "collectionURL": "https://ghcr.io",
    "cpes": [
      "cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "compiler-core",
      "compiler-cli"
    ],
    "packageName": "gleam-lang/gleam",
    "packageURL": "pkg:oci/gleam?repository_url=ghcr.io/gleam-lang",
    "product": "Gleam",
    "programFiles": [
      "compiler-core/src/config.rs",
      "compiler-core/src/docs.rs",
      "compiler-cli/src/docs.rs",
      "compiler-cli/src/fs.rs"
    ],
    "programRoutines": [
      {
        "name": "compiler_cli::docs::build_project"
      },
      {
        "name": "compiler_core::docs::generate_html"
      }
    ],
    "vendor": "Gleam",
    "versions": [
      {
        "lessThan": "v1.17.0-elixir",
        "status": "affected",
        "version": "v1.16.0-elixir",
        "versionType": "other"
      },
      {
        "lessThan": "v1.17.0-erlang",
        "status": "affected",
        "version": "v1.16.0-erlang",
        "versionType": "other"
      },
      {
        "lessThan": "v1.17.0-node",
        "status": "affected",
        "version": "v1.16.0-node",
        "versionType": "other"
      },
      {
        "lessThan": "v1.17.0-node-slim",
        "status": "affected",
        "version": "v1.16.0-node-slim",
        "versionType": "other"
      },
      {
        "lessThan": "v1.17.0-elixir-slim",
        "status": "affected",
        "version": "v1.16.0-elixir-slim",
        "versionType": "other"
      },
      {
        "lessThan": "v1.17.0-erlang-slim",
        "status": "affected",
        "version": "v1.16.0-erlang-slim",
        "versionType": "other"
      },
      {
        "lessThan": "v1.17.0-erlang-alpine",
        "status": "affected",
        "version": "v1.16.0-erlang-alpine",
        "versionType": "other"
      },
      {
        "lessThan": "v1.17.0-elixir-alpine",
        "status": "affected",
        "version": "v1.16.0-elixir-alpine",
        "versionType": "other"
      },
      {
        "lessThan": "v1.17.0-node-alpine",
        "status": "affected",
        "version": "v1.16.0-node-alpine",
        "versionType": "other"
      },
      {
        "lessThan": "v1.17.0-scratch",
        "status": "affected",
        "version": "v1.16.0-scratch",
        "versionType": "other"
      }
    ]
  }
]