Search
Find a vulnerability
Search criteria
1 vulnerability by frostming
CVE-2026-73030 (GCVE-0-2026-73030)
Vulnerability from cvelistv5 – Published: 2026-08-10 20:09 – Updated: 2026-11-08 14:08 X_Open Source
VLAI
EPSS
VEX
Title
unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape
Summary
unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 17:16 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/frostming/unearth/issues/180 | technical-descriptionexploitissue-tracking |
| https://github.com/frostming/unearth/pull/181 | issue-trackingpatch |
| https://github.com/frostming/unearth/commit/6c781… | patch |
| https://www.vulncheck.com/advisories/unearth-path… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| frostming | unearth |
Affected:
0 , ≤ 0.18.2
(semver)
Unaffected: 6c78164e7bfa28b8b3d6f247b87e560692e3c8ba (git) cpe:2.3:a:frostming:unearth:0.12.1:*:*:*:*:python:*:* cpe:2.3:a:frostming:unearth:0.12.0:*:*:*:*:python:*:* cpe:2.3:a:frostming:unearth:0.11.2:*:*:*:*:python:*:* cpe:2.3:a:frostming:unearth:0.11.1:*:*:*:*:python:*:* cpe:2.3:a:frostming:unearth:0.11.0:*:*:*:*:python:*:* cpe:2.3:a:frostming:unearth:0.10.0:*:*:*:*:python:*:* cpe:2.3:a:frostming:unearth:0.9.3:*:*:*:*:python:*:* cpe:2.3:a:frostming:unearth:0.9.2:*:*:*:*:python:*:* cpe:2.3:a:frostming:unearth:0.9.1:*:*:*:*:python:*:* cpe:2.3:a:frostming:unearth:0.9.0:*:*:*:*:python:*:* cpe:2.3:a:frostming:unearth:0.8.1:*:*:*:*:python:*:* cpe:2.3:a:frostming:unearth:0.8.0:*:*:*:*:python:*:* cpe:2.3:a:frostming:unearth:0.7.2:*:*:*:*:python:*:* cpe:2.3:a:frostming:unearth:0.7.1:*:*:*:*:python:*:* cpe:2.3:a:frostming:unearth:0.7.0:*:*:*:*:python:*:* cpe:2.3:a:frostming:unearth:0.6.3:*:*:*:*:python:*:* cpe:2.3:a:frostming:unearth:0.6.2:*:*:*:*:python:*:* cpe:2.3:a:frostming:unearth:0.6.1:*:*:*:*:python:*:* cpe:2.3:a:frostming:unearth:0.6.0:*:*:*:*:python:*:* cpe:2.3:a:frostming:unearth:0.5.2:*:*:*:*:python:*:* |
Date Public
2026-07-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73030",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T17:16:01.368745Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T17:16:13.975Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"packageURL": "pkg:github/frostming/unearth",
"product": "unearth",
"repo": "https://github.com/frostming/unearth",
"vendor": "frostming",
"versions": [
{
"lessThanOrEqual": "0.18.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6c78164e7bfa28b8b3d6f247b87e560692e3c8ba",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frostming:unearth:0.12.1:*:*:*:*:python:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frostming:unearth:0.12.0:*:*:*:*:python:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frostming:unearth:0.11.2:*:*:*:*:python:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frostming:unearth:0.11.1:*:*:*:*:python:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frostming:unearth:0.11.0:*:*:*:*:python:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frostming:unearth:0.10.0:*:*:*:*:python:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frostming:unearth:0.9.3:*:*:*:*:python:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frostming:unearth:0.9.2:*:*:*:*:python:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frostming:unearth:0.9.1:*:*:*:*:python:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frostming:unearth:0.9.0:*:*:*:*:python:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frostming:unearth:0.8.1:*:*:*:*:python:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frostming:unearth:0.8.0:*:*:*:*:python:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frostming:unearth:0.7.2:*:*:*:*:python:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frostming:unearth:0.7.1:*:*:*:*:python:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frostming:unearth:0.7.0:*:*:*:*:python:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frostming:unearth:0.6.3:*:*:*:*:python:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frostming:unearth:0.6.2:*:*:*:*:python:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frostming:unearth:0.6.1:*:*:*:*:python:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frostming:unearth:0.6.0:*:*:*:*:python:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frostming:unearth:0.5.2:*:*:*:*:python:*:*",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "YU SUN"
}
],
"datePublic": "2026-07-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T14:08:42.209Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description",
"exploit",
"issue-tracking"
],
"url": "https://github.com/frostming/unearth/issues/180"
},
{
"name": "Pull Request",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/frostming/unearth/pull/181"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/frostming/unearth/commit/6c78164e7bfa28b8b3d6f247b87e560692e3c8ba"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/unearth-path-traversal-via-unnormalized-paths-and-symlink-escape"
}
],
"tags": [
"x_open-source"
],
"title": "unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-73030",
"datePublished": "2026-08-10T20:09:44.641Z",
"dateReserved": "2026-08-10T18:48:59.022Z",
"dateUpdated": "2026-11-08T14:08:42.209Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}