CVE-2026-55062: uniget CLI path traversal in hook file handling

CVE-2026-55062 · Severity: medium · CVSS 4 · Published 2026-09-17

uniget is a command-line package management tool that supports hook scripts to customize installation behavior. A path traversal vulnerability in the hook file editor allows attackers to read and modify arbitrary files outside the intended hooks directory by using directory escape sequences like "../../../..". This enables unauthorized access to sensitive system files such as /etc/passwd, compromising system security and potentially exposing confidential data.

Technologies: gitlab.com/uniget-org/cli (Go). Vendors: Go.

Quick answers

Is CVE-2026-55062 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55062 being exploited in the wild.
How severe is CVE-2026-55062?
Medium severity, with a CVSS score of 4, published 17 September 2026.
Which products and versions are affected?
gitlab.com/uniget-org/cli (Go) < 0.27.6, SEMVER:introduced=0,fixed=0.27.6.
Is there a fix for CVE-2026-55062?
Yes. gitlab.com/uniget-org/cli (Go): upgrade to 0.27.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55062 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55062?
Check whether you run gitlab.com/uniget-org/cli (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • gitlab.com/uniget-org/cli (Go): upgrade to 0.27.6 or later
    go get gitlab.com/uniget-org/cli@v0.27.6

Technical details

The vulnerability exists in hooks.go (lines 135–160) where user-controlled hook filenames are concatenated directly with the hooks directory path without validating or sanitizing path traversal sequences like "../". The vulnerable code constructs file paths by simply appending the unsanitized argument to the preInstallHooksDir string: `hookFile = preInstallHooksDir + "/" + hookFileName`. An attacker can invoke the `uniget hooks edit` command with a malicious filename containing "../" sequences to traverse outside the intended directory and read or edit arbitrary files on the system. The attack requires only command-line access to uniget and no special privileges. A proof-of-concept demonstrates reading /etc/passwd by passing `../../../../etc/passwd` as the hook filename. The vulnerability has been patched in version 0.27.6 with proper input validation and path normalization.

Affected products

  • uniget-org cli < 0.27.6

Identifiers

  • CVE-2026-55062
  • GHSA-m6jg-wr9m-cg2f
  • GO-2026-6247

Timeline

  • 2026-06-10: disclosed
  • 2026-06-10: patched: Version 0.27.6 released with fix
  • 2026-08-17: advisory: Published to GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.