An improper limitation of pathname validation in the local file store backend of self‑hosted Hexpm allows relative path traversal. This vulnerability, stemming from CWE‑22, can enable an attacker to access or modify files outside the designated storage directory by exploiting the get/put/delete operations in the Local Store module. The exposed ability to read or overwrite arbitrary files can compromise sensitive data or disrupt the registry's operation. This flaw affects Hexpm installations that use the local filesystem backend for package storage. The vulnerability is present in all releases prior to commit 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0, covering versions identified by the hash 931ee0ed46fa89218e0400a4f6e6d15f96406050 and earlier. The risk assessment shows a CVSS score of 6.9 and an EPSS of less than 1 %, indicating moderate severity with a low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. An attacker would most likely leverage any publicly exposed API or service that performs local store operations, potentially in a managed or shared hosting environment. Mitigation requires applying the fix or altering the deployment configuration to prevent such access.

Self‑hosted Hexpm installations that use the local filesystem backend for package storage. The vulnerability affects hexpm versions from commit 931ee0ed46fa89218e0400a4f6e6d15f96406050 up to, but not including, commit 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0. Hex.pm’s hosted service is not affected.

The CVSS score of 6.9 reflects a moderate impact with potential integrity breach of the registry’s file system. EPSS indicates a very low exploitation likelihood (< 1 %), and the vulnerability is not in CISA’s KEV catalog. Likely attackers would attempt path traversal via the exposed local store API endpoints (get, put, delete), especially if the registry is publicly reachable or shared. In environments where the local backend is isolated or the network is restricted, the risk remains low, but any exposed instance can allow unauthorized file access or modification.