Executive brief
uniget is a command-line package management tool that supports hook scripts to customize installation behavior. A path traversal vulnerability in the hook file editor allows attackers to read and modify arbitrary files outside the intended hooks directory by using directory escape sequences like "../../../..". This enables unauthorized access to sensitive system files such as /etc/passwd, compromising system security and potentially exposing confidential data.
Technical details
The vulnerability exists in hooks.go (lines 135–160) where user-controlled hook filenames are concatenated directly with the hooks directory path without validating or sanitizing path traversal sequences like "../". The vulnerable code constructs file paths by simply appending the unsanitized argument to the preInstallHooksDir string: `hookFile = preInstallHooksDir + "/" + hookFileName`. An attacker can invoke the `uniget hooks edit` command with a malicious filename containing "../" sequences to traverse outside the intended directory and read or edit arbitrary files on the system. The attack requires only command-line access to uniget and no special privileges. A proof-of-concept demonstrates reading /etc/passwd by passing `../../../../etc/passwd` as the hook filename. The vulnerability has been patched in version 0.27.6 with proper input validation and path normalization.
Affected products
- uniget-org cli < 0.27.6
Timeline
- 2026-06-10: disclosed
- 2026-06-10: patched: Version 0.27.6 released with fix
- 2026-08-17: advisory: Published to GitHub Advisory Database