Gleam’s documentation generator allows path traversal through the documentation.pages entries defined in gleam.toml, which are incorporated into filesystem paths without sufficient validation or confinement. The documentation.pages[].path field can be crafted to place generated documentation files outside the intended build output directory, and the documentation.pages[].source field can reference arbitrary files for inclusion. This weakness enables a local attacker who can influence the project or gleam.toml content to read files that belong to the user’s system, or to overwrite files outside the project directory, thereby violating confidentiality, integrity, and potentially availability of the affected system.

The vulnerability affects the Gleam compiler and tooling for releases from version 1.16.0 through 1.17.0.

The CVSS score of 4.6 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. However, the attack vector is inferred to be local: an attacker must convince a victim to run gleam docs build on a project or gleam.toml file that they control or within a trusted environment. Once the build process executes, the path traversal can be used to read or write arbitrary files on the local filesystem. The lack of mitigation built into the tool itself means the risk depends heavily on the operational controls in place.