unearth contains a path traversal flaw in its is_within_directory function because it does not normalize paths before checking containment. This allows crafted tar archives that include "../" sequences or symlink members to escape the intended directory. An attacker can supply such a malicious archive and cause unearth to write files to any location on the filesystem that the process can access, potentially exposing or modifying sensitive data, or overwriting configuration files that enable remote code execution if exploited further.

The flaw exists in the open‑source utility frostming:unearth for all releases up to and including 0.18.2, which is packaged as a Python module. Systems that host or run unearth and accept user‑supplied tar archives are susceptible; any deployment that processes such archives without additional filtering falls into this risk scope.

The CVSS score of 7.2 indicates high severity, and the vulnerability is local and remote depending on whether unearth is exposed to external inputs. The EPSS score is not available, but the preliminary data suggests exploitation is plausible, especially in environments where unearth is publicly accessible. The issue is not currently listed in CISA’s KEV catalog, but its high impact warrants immediate attention.