CVE-2026-73030 unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape
Attackers can exploit path traversal in unearth to write files to arbitrary locations via malicious tar archives, requiring a patch update.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-73030?
CVE-2026-73030 is a high-severity path traversal vulnerability in frostming unearth, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.
Weakness: CWE-22
Which versions are affected by CVE-2026-73030?
Linux distribution packages (1)
python-unearth openSUSE:Leap 16.0 | All versions | 0.17.3-bp160.2.1 |
How do I fix CVE-2026-73030?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-73030 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73030 exists.
Sources
Also known as DEBIAN-CVE-2026-73030, GHSA-2fcv-9f95-p67v, UBUNTU-CVE-2026-73030, openSUSE-SU-2026:21606-1.