CVE-2026-55062 uniget: Path Traversal in Hook Files - Directory Escape Vulnerability
Attackers can escape the hooks directory via path traversal in the edit command, allowing unauthorized access or modification of files outside the intended scope.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55062?
CVE-2026-55062 is a high-severity path traversal vulnerability in uniget-org cli, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privileges of the uniget process account. This issue is fixed in version 0.27.6.
Which versions are affected by CVE-2026-55062?
3 open source packages ship an affected version, including gitlab.com/uniget-org/cli.
| Package | Affected | Fixed in |
|---|---|---|
gitlab.com/uniget-org/cli Go | All versions | 0.27.6 |
gitlab.com/uniget-org/cli Go | All versions | 0.27.6 |
gitlab.com/uniget-org/cli Go | All versions | 0.27.6 |
How do I fix CVE-2026-55062?
Upgrade gitlab.com/uniget-org/cli to 0.27.6 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-55062 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55062 exists.
Sources
Also known as GHSA-m6jg-wr9m-cg2f, GO-2026-6247.