CVE-2026-23939

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Relative Path Traversal. This vulnerability is associated with program files lib/hexpm/store/local.ex and program routines 'Elixir.Hexpm.Store.Local':get/3, 'Elixir.Hexpm.Store.Local':put/4, 'Elixir.Hexpm.Store.Local':delete/2, 'Elixir.Hexpm.Store.Local':delete_many/2. This issue does NOT affect hex.pm the service. Only self-hosted deployments using the Local Storage backend are affected. This issue affects hexpm: from 931ee0ed46fa89218e0400a4f6e6d15f96406050 before 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0.

• CWE-22

• https://cna.erlef.org/cves/CVE-2026-23939.html
• https://github.com/hexpm/hexpm/commit/5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0Patch
• https://github.com/hexpm/hexpm/security/advisories/GHSA-42mv-r64p-4869Mitigation, Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-23939

Published

Feb 26, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23931The frontend validatate.api.exists action can be exploited b…4.3
• CVE-2026-23933In Zabbix 7.4 the cryptographic key used for signing Fronten…9.1
• CVE-2026-23934An authenticated user is able to cause disproportionate CPU …6.5
• CVE-2026-23935A Zabbix administrator is able to read out of bounds memory …4.9
• CVE-2026-23937The Zabbix API host.get action can be exploited by authentic…6.5
• CVE-2026-23938An authenticated administrator is able to crash Zabbix serve…4.9
• CVE-2026-2394Buffer Over-read vulnerability in RTI Connext Professional (…6.5
• CVE-2026-23940Uncontrolled Resource Consumption vulnerability in hexpm hex…6.5
• CVE-2026-23941Inconsistent Interpretation of HTTP Requests ('HTTP Request …9.4
• CVE-2026-23942Improper Limitation of a Pathname to a Restricted Directory …5.4
• CVE-2026-23943Improper Handling of Highly Compressed Data (Compression Bom…5.3
• CVE-2026-23944Arcane is an interface for managing Docker containers, image…9.8