The path‑traversal bug is located in the hooks edit command of uniget prior to version 0.27.6. An attacker can supply a hook file name that includes parent‑directory components; the application concatenates this name with the configured hooks directory without validation. The resulting path is then passed to the chosen editor, which runs with the same privileges as the uniget process. This allows the tool to read or modify any file on the system that the process can access, potentially leading to unauthorized file manipulation.

The vulnerability affects the uniget‑org:cli product in all releases before 0.27.6. Systems that run uniget 0.27.5 or earlier and use the hooks edit command are vulnerable. No operating‑system restrictions are noted; the flaw is rooted in application logic rather than platform details.

The CVSS score of 8.4 denotes high severity, but the EPSS score of < 1 % indicates a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, and no public exploits are openly documented. Exploitation requires local access to the uniget process to supply the malicious hook file name; there is no known network‑based vector. The flaw has been fixed in version 0.27.6, so upgrading mitigates the risk.