gleam vulnerabilities (openSUSE)
7 vulnerabilities.
-
gleamopenSUSE zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0) 7.4 High -
gleamopenSUSE zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE 10.0 Critical -
gleamopenSUSE Path traversal in Gleam via unvalidated package application names 5.9 Medium -
gleamopenSUSE Insufficient verification of Hex package metadata in Gleam 7.6 High -
gleamopenSUSE Symlink Following in Hex Package Export Allows Embedding Files Outside Project Root 5.1 Medium -
gleamopenSUSE Path Traversal in build/packages/packages.toml Allows Arbitrary Directory Deletion 5.6 Medium -
gleamopenSUSE Path Traversal in gleam docs build via documentation.pages Allows Arbitrary File Read and Write 4.6 Medium