Description

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-10T21:17:26.450Z",
  "pubdate": "2026-08-10T21:17:26.450Z",
  "executiveSummary": "Unearth through 0.18.2 suffers from a path traversal vulnerability residing within the is_within_directory function. This flaw allows malicious actors to execute arbitrary file write operations across the filesystem locations accessible to the running process.\nThe vulnerability is triggered when processing untrusted inputs, specifically via malicious tar archives containing traversal sequences or symbolic link members. Because the affected function fails to properly normalize paths prior to validation, directory containment checks are effectively bypassed.\nSuccessful exploitation grants attackers the capability to overwrite or create files outside the intended destination directory, potentially leading to unauthorized system modifications, arbitrary code execution, or privilege escalation depending on the execution context and file permissions of the process.\nSystems processing external archives using vulnerable versions of unearth are at risk, requiring immediate remediation through version upgrades or application-level path validation hardening.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient input validation implemented within the is_within_directory function of the unearth package. Specifically, the component evaluates directory containment boundaries by performing string comparisons or checks without first normalizing the target paths.\nPath normalization is a critical security control that resolves relative path components, redundant separators, and dot-dot sequences. Because unearth through 0.18.2 omits this normalization step, directory traversal sequences such as ../ are preserved during the validation phase.\nThe exploitation method relies on supplying maliciously crafted tar archives to the application utilizing unearth. An attacker constructs archive members containing explicit directory traversal patterns or malicious symbolic links designed to reference target locations outside the intended extraction root directory.\nThe step-by-step attack flow proceeds as follows: First, the attacker crafts a malicious tar archive embedding traversal payloads or symlink members. Second, the victim or automated system passes this archive to the unearth component for extraction or processing. Third, unearth invokes the vulnerable is_within_directory function to validate the destination path of each archive member. Fourth, because the function fails to normalize the path, the traversal sequences bypass the containment check. Finally, the file extraction routine writes the payload contents to an arbitrary filesystem location accessible to the process context.\nThe vulnerable component is identified as the is_within_directory function within unearth versions through 0.18.2. The issue has been addressed and fixed in commit 6c78164.\nExploitation does not require authentication or specific privilege levels if the application processes untrusted archives automatically. The impact post-exploitation includes unauthorized file creation, potential overwriting of critical system or application files, and subsequent compromise of system integrity."
}