Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22 CWE-22 at MITRE
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVEs
CVEs for Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Path Traversal in gleam docs build via documentation.pages Allows Arbitrary File Read and Write |
pkg:sid/gleam.run/gleam
pkg:oci/gleam
|
CVE-2026-32685 | 2026-06-02 |
| Path Traversal in build/packages/packages.toml Allows Arbitrary Directory Deletion |
pkg:sid/gleam.run/gleam
pkg:oci/gleam
|
CVE-2026-43965 | 2026-06-02 |
| SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT |
pkg:otp/ssh
|
CVE-2026-32147 | 2026-04-21 |
| Improper Path Validation in Git Dependency Handling Allows Arbitrary File System Modification |
pkg:sid/gleam.run/gleam
pkg:oci/gleam
|
CVE-2026-32146 | 2026-04-11 |
| SFTP root escape via component-agnostic prefix check in ssh_sftpd |
pkg:otp/ssh
|
CVE-2026-23942 | 2026-03-13 |
| Path Traversal in wisp.serve_static allows arbitrary file read | CVE-2026-28807 | 2026-03-10 | |
| Path Traversal in Local File Store Backend | CVE-2026-23939 | 2026-02-26 | |
| Absolute path traversal in zip:unzip/1,2 |
pkg:otp/stdlib
|
CVE-2025-4748 | 2025-06-16 |