Unearth (<= 0.18.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/unearth--0.18.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 10 Aug 2026 21:40:43 +0000Path Traversal Vulnerability in unearth Libraryhttps://feed.craftedsignal.io/briefs/2026-08-unearth-path-traversal/Mon, 10 Aug 2026 21:40:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-unearth-path-traversal/The unearth library version 0.18.2 and earlier contains a path traversal vulnerability in the is_within_directory function that permits arbitrary file writes via malicious archives.The unearth library, used for utility operations in Python environments, contains a critical path traversal vulnerability (CVE-2026-73030) in its is_within_directory function. The vulnerability stems from the library's failure to normalize file paths before performing directory containment validation. By exploiting this flaw, an attacker can supply specially crafted tar archives containing directory traversal sequences (e.g., ../) or malicious symlinks to break out of the target extraction directory. Successful exploitation allows the attacker to write files to arbitrary locations on the filesystem, restricted only by the permissions of the process executing the unearth library. This vulnerability impacts all versions up to 0.18.2. Users are advised to update to a patched version, as the fix was implemented in commit 6c78164. Given the nature of libraries like unearth, this could affect a wide range of downstream applications that process external archives.

Impact

The vulnerability carries a CVSS v3.1 base score of 8.1, indicating a high impact on system integrity and security. If exploited, an attacker could achieve arbitrary file write, potentially leading to remote code execution by overwriting critical system binaries, configuration files, or startup scripts, depending on the context in which the library is utilized within an application.

Recommendation

  • Identify all instances of the unearth library within the environment and inventory applications that utilize version 0.18.2 or earlier.
  • Upgrade the unearth dependency to a version containing the fix for CVE-2026-73030 (as implemented in commit 6c78164).
  • Implement file integrity monitoring (FIM) on directories where third-party archives are extracted to detect anomalous file creation patterns.
  • Run processes that utilize unearth with the principle of least privilege, ensuring the service user has minimal write access to the filesystem.
]]>highadvisorypath-traversalvulnerabilitysupply-chain