CVE-2026-73030 in unearth
Summary
by MITRE • 08/11/2026
unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability in unearth version 0.18.2 represents a critical path traversal flaw that stems from inadequate path normalization within the is_within_directory function. This weakness allows attackers to bypass directory containment checks by exploiting the failure to properly normalize file paths before validation. The issue manifests when processing tar archives containing maliciously crafted symlink members or traversal sequences that utilize ../ patterns to escape intended directory boundaries.
The technical implementation of this vulnerability resides in how the software handles path validation logic during archive extraction operations. When the is_within_directory function processes file paths, it does not perform proper canonicalization or normalization of the input paths before determining whether they remain within the designated extraction directory. This omission creates a window of opportunity for attackers to craft malicious tar archives that contain entries with relative path sequences designed to traverse upward through the filesystem hierarchy.
From an operational perspective, this vulnerability presents significant security implications for systems that rely on unearth for archive processing and extraction tasks. Attackers can leverage this flaw to write files to arbitrary locations accessible to the process executing the extraction routine, potentially leading to privilege escalation, data corruption, or unauthorized system compromise. The impact extends beyond simple file overwrites as attackers may create malicious symlinks or place executables in critical system directories.
The vulnerability aligns with CWE-22 Path Traversal and follows patterns commonly associated with directory traversal attacks documented in the ATT&CK framework under T1059 Command and Scripting Interpreter and T1566 Phishing. The weakness specifically maps to CWE-22 as it allows attackers to traverse directories by manipulating path sequences, while the improper path normalization directly enables the bypass of containment mechanisms designed to restrict file system access.
Mitigation strategies should focus on implementing proper path normalization before directory validation, ensuring that all input paths are canonicalized using functions like realpath or equivalent canonicalization routines. The fix implemented in commit 6c78164 demonstrates the importance of sanitizing user-provided paths through proper normalization techniques that resolve symbolic links and eliminate relative path components. Additionally, systems should implement strict access controls limiting the privileges of processes handling untrusted archive files, employ sandboxing mechanisms, and regularly audit file system access patterns to detect anomalous behavior indicative of path traversal attempts. Organizations should also consider implementing automated vulnerability scanning tools that can identify similar path traversal patterns in other software components and maintain up-to-date security patches for all dependencies.