# CVE-2026-103060: Erlang rebar3 path traversal in dependency app names

Source: https://junglewise.ai/threats/cve-2026-103060-improper-limitation-of-a-pathname-to-a-restricted-directory-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-103060 · Severity: info · Published 2026-10-12

rebar3 is a build and dependency management tool for Erlang projects. A malicious package publisher can manipulate the app name field in package metadata to contain path traversal sequences like "../../../../". When a developer runs rebar3 to fetch dependencies, this causes the tool to delete a directory outside the project and replace it with the attacker's package files, potentially enabling code execution or data destruction.

Vendors: [Erlang](https://junglewise.ai/threats/vendors/erlang).

## Quick answers

**Is CVE-2026-103060 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103060 being exploited in the wild.

**How severe is CVE-2026-103060?** Informational severity, published 12 October 2026.

**Which products and versions are affected?** Erlang Rebar3 3.7.0-rc1 through 3.27.1.

**Is there a fix for CVE-2026-103060?** Yes: fixed in rebar3 3.27.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103060 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-103060?** Check whether you run Erlang Rebar3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in rebar3 3.27.2

## Technical details

The vulnerability exists in rebar3's dependency resolution: the app field from Hex registry metadata is used as a directory name without validation, and passed to filename:join() and rm_rf() without collapsing ".." path segments. An attacker can set app to a traversal path like "../../../../target", causing rebar_fetch:download_source_online/2 to delete that resolved directory and extract package files into it before the dependency's rebar.config.script is evaluated. No user interaction beyond running a normal rebar3 get-deps command is required.

## Affected products

- Erlang rebar3 3.7.0-rc1 through 3.27.1

## Timeline

- 2026-10-12: disclosed
- 2026-10-12: patched

## References

- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-103060.html](https://cna.erlef.org/cves/CVE-2026-103060.html)

## Related threats

- [Erlang OTP erl_tar infinite loop in GNU sparse member handling](https://junglewise.ai/threats/cve-2026-96596-loop-with-unreachable-exit-condition-infinite-loop-vulnerability)