uniget CLI EUVD-2026-82370

Requires the ability to execute the uniget CLI locally and pass an attacker-controlled hook filename to the hook subcommands (hooks edit, hooks remove, or hook processing), specifically the pre-install/post-install hook filename argument, which is concatenated to the hooks directory without sanitizing '../'. For the read-file PoC, an editor must be configured via the EDITOR or UNIGET_EDITOR environment variable (e.g. EDITOR=cat). Exploitation is LIMITED by: local access only (no remote/network path), the CLI operating with the invoking user's privileges (so meaningful impact requires uniget to run in a privileged, automated, or multi-user context where the hook argument is attacker-influenced), and affected versions <0.27.6 (fixed in 0.27.6, which adds an absolute-path prefix check against hooksDir and rejects symlinks).

The vendor scores this CVSS 4.0 8.4 (High), but that number overstates the real-world priority once every signal is weighed together. The vector is unambiguously local (AV:L) and requires privileges (PR:L) - the 'attacker' is whoever can already invoke the uniget CLI, and the PoC simply reads /etc/passwd by feeding '../../../../etc/passwd' to uniget hooks edit. A publicly available exploit (PoC) exists and is confirmed in the GHSA-m6jg-wr9m-cg2f advisory, and a vendor patch (v0.27.6) is available - but there is no CISA KEV listing and no EPSS score in the input, so exploitation status is: publicly available exploit code exists, with no evidence of active exploitation in the wild. The key nuance the raw score hides: because exploitation is local and the CLI acts with the invoking user's own privileges, the classic PoC (a user reading their own /etc/passwd) is largely a self-exploit with little escalation value. The genuine risk arises only when uniget is run in a privileged or shared/automated context (e.g. root-run installs, CI pipelines, or a service invoking it with attacker-influenced hook arguments), where the traversal plus the file-write/edit primitive (VI:H) becomes a real integrity threat. Net: real and worth patching, but a targeted/low-widespread issue, not an internet-facing emergency. Signals are consistent (local vector matches local PoC); the main caveat is that VC:H/VI:H assume a privileged execution context that the base description does not establish.

A user or automated process invokes uniget hooks edit --type=pre-install (or the remove/process hook paths) with an attacker-controlled filename containing '../' sequences; the unsanitized concatenation preInstallHooksDir + "/" + hookFileName resolves outside the hooks directory. With EDITOR/UNIGET_EDITOR set (e.g. cat), the attacker reads arbitrary files such as /etc/passwd, and the edit/write path allows manipulating files outside the hooks directory. A working PoC is published in the GHSA advisory; if uniget runs with elevated privileges the same primitive escalates to privileged file read/write.