CVE-2026-73030: unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape
unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
unearthto a version that resolves this vulnerability.Fixed in 0.18.2Patch 6c78164
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73030?
CVE-2026-73030 has a severity rating of high, specifically with a score of 8.1.
What does CVE-2026-73030 exploit?
CVE-2026-73030 exploits a path traversal vulnerability in unearth version 0.18.2.
How do I fix CVE-2026-73030?
To fix CVE-2026-73030, you should update your unearth software to a version that includes the fix from commit 6c78164.
What type of vulnerability is CVE-2026-73030?
CVE-2026-73030 is classified as a Path Traversal vulnerability.
How can CVE-2026-73030 be exploited by attackers?
Attackers can exploit CVE-2026-73030 by supplying malicious tar archives containing symlink members that bypass directory containment checks.