{"cve":"CVE-2026-55062","nvd":{"published":"2026-09-17T19:16:51.510","modified":"2026-09-30T17:32:07.107","status":"Deferred","description":"uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privileges of the uniget process account. This issue is fixed in version 0.27.6.","cvss_v4":{"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.4},"cvss_v3":null,"cwes":["CWE-22","CWE-23","CWE-36","CWE-73"],"references":["https://github.com/uniget-org/cli/commit/7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91","https://github.com/uniget-org/cli/releases/tag/v0.27.6","https://github.com/uniget-org/cli/security/advisories/GHSA-m6jg-wr9m-cg2f","https://github.com/uniget-org/cli/security/advisories/GHSA-m6jg-wr9m-cg2f"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:55:23.253742848+00:00"},"epss":{"cve":"CVE-2026-55062","score":0.00164,"percentile":0.05598,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-m6jg-wr9m-cg2f","url":"https://osv.dev/vulnerability/GHSA-m6jg-wr9m-cg2f","summary":"uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability","modified":"2026-08-18T15:11:05.263719600Z","packages":[{"ecosystem":"Go","name":"gitlab.com/uniget-org/cli","purl":"pkg:golang/gitlab.com/uniget-org/cli","ranges":["<0.27.6"],"fixed":["0.27.6"]}]},{"id":"GO-2026-6247","url":"https://osv.dev/vulnerability/GO-2026-6247","summary":"uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability in gitlab.com/uniget-org/cli","modified":"2026-08-18T15:00:27.150579233Z","packages":[{"ecosystem":"Go","name":"gitlab.com/uniget-org/cli","purl":"pkg:golang/gitlab.com/uniget-org/cli","ranges":["<0.27.6"],"fixed":["0.27.6"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}