EUVD-2026-55802
GHSA-2fcv-9f95-p67v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker serves the archive over the network with no privileges; victim must trigger extraction (UI:R); writes but cannot read, so C:N; scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.
AnalysisAI
Path traversal in the unearth Python package discovery library through version 0.18.2 allows an attacker who controls or compromises a package source to write arbitrary files to any filesystem location accessible to the extracting process. The flaw resides in the is_within_directory function, which performs only a lexical path containment check without resolving symlinks or normalizing ../ sequences via os.path.realpath(), meaning maliciously crafted tar archive members silently bypass the extraction guard. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target system run unearth version 0.18.2 or earlier and extract a tar archive sourced from an attacker-controlled or compromised package index. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 7.2 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H) correctly characterizes the core threat: no privileges are required on the attacker side, attack complexity is low once a malicious package is in place, and both integrity and availability impacts are high because arbitrary file writes can corrupt or replace binaries, configuration files, or interpreter entry points. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes a malicious Python package to PyPI or a private index (or compromises a legitimate package version) containing a tar archive with symlink members whose link targets use ../ sequences to escape the extraction directory. When a developer or CI pipeline resolves dependencies using PDM or another unearth-backed tool, the library extracts the archive and the unnormalized is_within_directory check is bypassed, silently writing the attacker-supplied file to an arbitrary writable location - such as overwriting a cron job, an SSH authorized_keys file, or a Python entry-point script. … |
| Remediation | Upgrade unearth to the first release incorporating commit 6c78164e7bfa28b8b3d6f247b87e560692e3c8ba (https://github.com/frostming/unearth/commit/6c78164e7bfa28b8b3d6f247b87e560692e3c8ba); confirm the installed version exceeds 0.18.2 by running pip show unearth. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Identify all systems using unearth version 0.18.2 or earlier within 24 hours to assess your supply chain exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today