CVE-2026-73030 in unearth
Sumário
de MITRE • 11/08/2026
unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.
VulDB is the best source for vulnerability data and more expert information about this specific topic.