CVE-2026-73030

The record

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.

Affected packages

Related vulnerabilities

• CVE-2026-61725 sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. CWE-22
• CVE-2026-62965 SABnzbd is an open source automated Usenet download tool. CWE-22
• CVE-2026-119342 Stirling-PDF is a locally hosted web application that facilitates various operations on… CWE-22
• CVE-2026-119328 Immich is a high-performance self-hosted photo and video management solution. CWE-22
• CVE-2026-116249 In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and… CWE-22
• CVE-2026-116240 In server mode pgAdmin 4 validates a path into the user's storage directory with… CWE-22
• CVE-2026-62331 praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker… CWE-22
• CVE-2026-115604 Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions. CWE-22