Description
unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.
Published: 2026-08-10
Score: 7.2 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 10 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.
Title unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape
First Time appeared Frostming
Frostming unearth
Weaknesses CWE-22
CPEs cpe:2.3:a:frostming:unearth:0.10.0:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.11.0:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.11.1:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.11.2:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.12.0:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.12.1:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.5.2:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.6.0:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.6.1:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.6.2:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.6.3:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.7.0:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.7.1:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.7.2:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.8.0:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.8.1:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.9.0:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.9.1:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.9.2:*:*:*:*:python:*:*
cpe:2.3:a:frostming:unearth:0.9.3:*:*:*:*:python:*:*
Vendors & Products Frostming
Frostming unearth
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H'}

cvssV4_0

{'score': 7.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Frostming Unearth
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-10T20:09:44.641Z

Reserved: 2026-08-10T18:48:59.022Z

Link: CVE-2026-73030

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses