Improper path validation in Gleam’s compiler allows an attacker to craft git dependency names that include relative or absolute traversal characters. During the dependency download step, the compiler creates, deletes, or overwrites directories based on these names, enabling the modification of arbitrary files outside the intended dependency directory. This can result in data loss and, in some cases, provide a foothold for execution by overwriting sensitive configuration or hook files. The weakness is a classic directory traversal flaw (CWE‑22).

The vulnerability impacts versions of Gleam from 1.9.0‑rc1 through 1.15.4. Users of the compiler within this range who fetch dependencies from git repositories—whether directly or via transitive dependencies—are at risk. No specific operating system or environment is singled out; the flaw resides entirely in the Gleam build tool.

The CVSS score of 8.3 indicates high severity, and the very low EPSS score (<1%) suggests modest current exploitation rates. The flaw is not listed in the CISA KEV catalog, reflecting limited public exploitation data. Attackers would likely need to establish malicious git dependencies in a Gleam project's configuration or supply a subjectively controlled repository, implying that privileged build environments or scripts that automatically resolve dependencies present the primary attack surface.