rootpwn

critical · CVSS v3 9.8 · CVSS v4 8.4

CVE-2026-55062

CVE-2026-55062 exposes a directory traversal flaw in the uniget installer’s hooks edit command, allowing an attacker to edit files outside t

Overview

CVE-2026-55062 exposes a directory traversal flaw in the uniget installer’s hooks edit command, allowing an attacker to edit files outside the intended hooks directory. The vulnerability exists in all versions prior to 0.27.6 and can be exploited by any process running uniget with elevated privileges. It enables modification of arbitrary system files, compromising integrity and confidentiality.

Description

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privileges of the uniget process account. This issue is fixed in version 0.27.6.

Impact

The flaw permits an attacker to alter or read files outside the hooks directory, potentially modifying configuration files, scripts, or other critical assets. This threatens the integrity of the system and the confidentiality of sensitive data. Users running uniget with administrative rights are most at risk, as the process can write to any location the account can access. Availability could also be impacted if critical files are corrupted.

Remediation

Upgrade uniget to version 0.27.6 or later, where the directory traversal is fixed. If an upgrade is not immediately possible, run uniget under a non‑privileged user account and restrict the editor path to a safe directory. Additionally, enforce file system permissions to prevent write access to sensitive directories by the uniget process.

Risk context

The vulnerability is rated critical with a CVSS v3 score of 9.8 and no EPSS data, indicating a high likelihood of exploitation. Defenders should treat this as a high‑priority issue and apply the patch promptly.

Affected products

  • uniget 0.27.5
  • uniget 0.27.4
  • uniget 0.27.3
  • uniget 0.27.2
  • uniget 0.27.1
  • uniget 0.27.0
  • uniget 0.26.x
  • uniget 0.25.x

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
9.8
CVSS v4
8.4
EPSS
—

directory-traversal privilege-escalation uniget critical container-tools patch defense

← All CVEs

Related CVEs

critical

CVE-2026-62874

CVE‑2026‑62874 exposes a flaw in Azure Billing where data authenticity is not properly verified. An attacker can exploit this to gain elevated privileges on the network, potentially accessing or modifying billing and subscription data. The vulnerability is critical with a CVSS v3 score of 10.0.

View analysis

critical

CVE-2026-69843

CVE‑2026‑69843 is a critical authentication bypass in Microsoft Fabric that lets an attacker spoof credentials and gain elevated privileges across the network. The flaw allows unauthorized users to impersonate legitimate accounts, potentially accessing sensitive data and services. It is a high‑risk vulnerability that requires immediate attention from defenders.

View analysis

critical

CVE-2026-85878

CVE-2026-85878 exposes an improper authorization flaw in Azure Database for PostgreSQL that lets an authenticated user gain elevated privileges across the network. The vulnerability can be exploited by users who already have access to the database, enabling them to perform actions beyond their intended scope. It is critical because it bypasses normal role boundaries and can lead to widespread compromise of data and services.

View analysis

critical

CVE-2026-93453

SOGo versions before 5.12.11 can construct password-reset links using a client-supplied Origin header as the link authority. This can cause valid recovery tokens to be delivered in links pointing to attacker-controlled domains. It matters because it can enable account takeover for users who rely on SOGo password recovery.

View analysis