CVE-2026-73030

HIGH

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.

CVSS v3.1 Score

8.1
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
HIGH
Published: 8/10/2026Modified: 8/11/2026

Related Intelligence (1)

HIGHVulnerability

NVD HIGH: CVE-2026-73030 — unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulne...

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.

CVE-2026-73030
NIST NVD

References (4)

https://github.com/frostming/unearth/commit/6c78164e7bfa28b8b3d6f247b87e560692e3c8bahttps://github.com/frostming/unearth/issues/180https://github.com/frostming/unearth/pull/181https://www.vulncheck.com/advisories/unearth-path-traversal-via-unnormalized-paths-and-symlink-escape