Description
unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.
Published: 2026-08-10
Score: 7.2 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 10 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.
Title unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape
First Time appeared Frostming
Frostming unearth
Weaknesses CWE-22
CPEs cpe:2.3:a:frostming:unearth:0.10.0:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.11.0:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.11.1:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.11.2:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.12.0:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.12.1:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.5.2:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.6.0:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.6.1:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.6.2:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.6.3:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.7.0:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.7.1:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.7.2:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.8.0:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.8.1:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.9.0:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.9.1:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.9.2:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.9.3:*:*:*:*:python:*:*
Vendors & Products Frostming
Frostming unearth
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H'}

cvssV4_0

{'score': 7.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Frostming Unearth
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-10T20:09:44.641Z

Reserved: 2026-08-10T18:48:59.022Z

Link: CVE-2026-73030

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')