# CVE-2026-32685: Gleam path traversal in documentation pages handling

Source: https://junglewise.ai/threats/cve-2026-32685-gleam-path-traversal-in-documentation-pages-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-32685 · Severity: info · CVSS 4.6 · Published 2026-06-02

A vulnerability in the Gleam programming language's documentation tool could allow a malicious project to read or write files outside of its intended directory. If a developer runs the documentation build command on an untrusted project, sensitive local files could be leaked into the generated documentation or arbitrary files could be overwritten on their system. This poses a risk to the confidentiality of developer data and the integrity of the local file system.

## Quick answers

**Is CVE-2026-32685 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32685 being exploited in the wild.

**How severe is CVE-2026-32685?** Informational severity, with a CVSS score of 4.6, published 2 June 2026.

**Which products and versions are affected?** Gleam Gleam 1.16.0 to 1.17.0.

**Is there a fix for CVE-2026-32685?** A patch was published on 2026-06-02: Fix released in version 1.17.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32685 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-32685?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in Gleam's handling of custom documentation pages defined in the 'gleam.toml' configuration file. The 'documentation.pages[].path' and 'documentation.pages[].source' fields are not sufficiently validated, allowing an attacker to use relative path components (e.g., '../') to escape the intended project and output directories. By convincing a victim to run 'gleam docs build' on a malicious project, an attacker can read arbitrary local files and embed them in the documentation output, or write generated documentation files to locations outside the 'build/dev/docs/' directory. The issue was addressed in version 1.17.0 by implementing stricter path validation during deserialization.

## Affected products

- Gleam Gleam 1.16.0 to 1.17.0

## Timeline

- 2026-04-25: other: Initial fix developed
- 2026-06-02: disclosed: Vulnerability disclosed and CVE assigned
- 2026-06-02: patched: Fix released in version 1.17.0

## References

- [https://cna.erlef.org/cves/CVE-2026-32685.html](https://cna.erlef.org/cves/CVE-2026-32685.html)
- [https://github.com/gleam-lang/gleam/commit/81570611906b6b0039c948037094d09a68700f3a](https://github.com/gleam-lang/gleam/commit/81570611906b6b0039c948037094d09a68700f3a)
- [https://github.com/gleam-lang/gleam/commit/c9230cd3045de8fd8481dae3a4557c0146df1430](https://github.com/gleam-lang/gleam/commit/c9230cd3045de8fd8481dae3a4557c0146df1430)
- [https://github.com/gleam-lang/gleam/security/advisories/GHSA-wjx8-7w8m-p4v7](https://github.com/gleam-lang/gleam/security/advisories/GHSA-wjx8-7w8m-p4v7)