CVE-2026-55062: uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability

August 17, 2026

Path Traversal vulnerability in hook filename handling allows attackers to access and manipulate arbitrary files outside the hooks directory via directory escape sequences like passwd.

Details File: hooks.go Lines 135-160

hookFileName := args[0]  // User input not validated
hookFile = preInstallHooksDir + "/" + hookFileName  // Direct concatenation

Hook filenames are concatenated directly without sanitizing ../ sequences, allowing directory traversal.

References

github.com/advisories/GHSA-m6jg-wr9m-cg2f
github.com/uniget-org/cli/commit/7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91
github.com/uniget-org/cli/releases/tag/v0.27.6
github.com/uniget-org/cli/security/advisories/GHSA-m6jg-wr9m-cg2f
nvd.nist.gov/vuln/detail/CVE-2026-55062

Code Behaviors & Features

Detect and mitigate CVE-2026-55062 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →