{"answers":{"affected":"3 open source packages ship an affected version, including gitlab.com/uniget-org/cli.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55062 exists.","fix":"Upgrade gitlab.com/uniget-org/cli to 0.27.6 or later.","what":"CVE-2026-55062 is a high-severity path traversal vulnerability in uniget-org cli, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-55062 and fix it if it is affected.\n\nWhat it is: CVE-2026-55062 is a high-severity path traversal vulnerability in uniget-org cli, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55062 exists.\n\nAffected packages and fixed versions:\n- gitlab.com/uniget-org/cli (Go): affected all versions; fixed in 0.27.6\n- gitlab.com/uniget-org/cli (Go): affected all versions; fixed in 0.27.6\n- gitlab.com/uniget-org/cli (Go): affected all versions; fixed in 0.27.6\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-55062/ (Markdown: https://insights.sbomify.com/CVE-2026-55062/index.md)","id":"CVE-2026-55062","markdown":"https://insights.sbomify.com/CVE-2026-55062/index.md","name":"CVE-2026-55062","record":{"aliases":["GHSA-m6jg-wr9m-cg2f","GO-2026-6247"],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["data_read","data_modify"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Go CLI installer","requires_auth":"low_privilege","summary":"Attackers can escape the hooks directory via path traversal in the edit command, allowing unauthorized access or modification of files outside the intended scope.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":8.4,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-36","name":"Absolute Path Traversal"},{"id":"CWE-23","name":"Relative Path Traversal"},{"id":"CWE-73","name":"External Control of File Name or Path"},{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"description":"uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privileges of the uniget process account. This issue is fixed in version 0.27.6.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"uniget: Path Traversal in Hook Files - Directory Escape Vulnerability","id":"CVE-2026-55062","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"path_traversal","year":"2026"},"n_packages":3,"n_references":3,"next":{"headline":"Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0","id":"CVE-2026-55064"},"packages":[{"ecosystem":"Go","fixed":["0.27.6"],"introduced":["0"],"last_affected":[],"package":"gitlab.com/uniget-org/cli","purl":null,"source":"GHSA-m6jg-wr9m-cg2f"},{"ecosystem":"Go","fixed":["0.27.6"],"introduced":["0"],"last_affected":[],"package":"gitlab.com/uniget-org/cli","purl":"pkg:golang/gitlab.com/uniget-org/cli","source":"GHSA-m6jg-wr9m-cg2f"},{"ecosystem":"Go","fixed":["0.27.6"],"introduced":["0"],"last_affected":[],"package":"gitlab.com/uniget-org/cli","purl":"pkg:golang/gitlab.com/uniget-org/cli","source":"GO-2026-6247"}],"prev":{"headline":"uniget: EDITOR Command Injection in uniget CLI","id":"CVE-2026-55061"},"products":["cli"],"published":"2026-09-17","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-09-23","vendors":["uniget-org"]},"summary":"Attackers can escape the hooks directory via path traversal in the edit command, allowing unauthorized access or modification of files outside the intended scope.","url":"https://insights.sbomify.com/CVE-2026-55062/"}