Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Use of Incorrectly-Resolved Name or Reference CWE-706 CWE-706 at MITRE
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
CVEs
CVEs for Use of Incorrectly-Resolved Name or Reference CWE-706
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass |
pkg:otp/stdlib
|
CVE-2026-47078 | 2026-07-27 |
| Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects | CVE-2026-48595 | 2026-06-02 | |
| Symlink Following in Hex Package Export Allows Embedding Files Outside Project Root |
pkg:sid/gleam.run/gleam
pkg:oci/gleam
|
CVE-2026-42795 | 2026-06-02 |
| Path Traversal in gleam docs build via documentation.pages Allows Arbitrary File Read and Write |
pkg:sid/gleam.run/gleam
pkg:oci/gleam
|
CVE-2026-32685 | 2026-06-02 |
| Path Traversal in build/packages/packages.toml Allows Arbitrary Directory Deletion |
pkg:sid/gleam.run/gleam
pkg:oci/gleam
|
CVE-2026-43965 | 2026-06-02 |
| SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT |
pkg:otp/ssh
|
CVE-2026-32147 | 2026-04-21 |
| Improper Path Validation in Git Dependency Handling Allows Arbitrary File System Modification |
pkg:sid/gleam.run/gleam
pkg:oci/gleam
|
CVE-2026-32146 | 2026-04-11 |
| SFTP root escape via component-agnostic prefix check in ssh_sftpd |
pkg:otp/ssh
|
CVE-2026-23942 | 2026-03-13 |
| Path Traversal in wisp.serve_static allows arbitrary file read | CVE-2026-28807 | 2026-03-10 | |
| Path Traversal in Local File Store Backend | CVE-2026-23939 | 2026-02-26 | |
| TFTP Path Traversal |
pkg:otp/inets
pkg:otp/tftp
|
CVE-2026-21620 | 2026-02-20 |
| Absolute path traversal in zip:unzip/1,2 |
pkg:otp/stdlib
|
CVE-2025-4748 | 2025-06-16 |