NVD HIGH: CVE-2026-73030 — unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulne...

Monday, August 10, 2026 at 09:17 PM UTC·Source: NIST NVD

Updated: Tuesday, August 11, 2026 at 06:00 AM UTC

Executive Summary

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-73030

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Aug 10, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Western Union gets New York nod for Intermax acquisition; still face California hurdles

Western Union has committed to maintain its store locations in New York State and cap fee increases for three years in order to head off opposition to its acquisition of rival Intermax.

2h agoFinextra

MEDIUMVulnerability

Polygon joins BofE's Digital Pound Lab to test cross-border settlement

Polygon Labs has joined Nobo Finance and Dun & Bradstreet for phase two of the Bank of England's Digital Pound Lab, testing near-instant cross-border settlement.

2h agoFinextra

CRITICALVulnerability

NVD CRITICAL: CVE-2026-19961 — A vulnerability was detected in Edimax EW-7478APC 1.04. Affected is the function...

A vulnerability was detected in Edimax EW-7478APC 1.04. Affected is the function formWlSiteSurvey of the file /goform/formWlSiteSurvey. Performing a manipulation of the argument selSSID results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-19961

2h agoNIST NVD