Frost Ming Unearth 0.9.0 for Python
Approved changes feed: RSS · Atom
cpe:2.3:a:frostming:unearth:0.9.0:*:*:*:*:python:*:*
part: a version: 0.9.0 update: *
| Vendor | Frostming (17763364-a34e-5ec3-aae1-5cf4b378abbe) |
|---|---|
| Product | Unearth (06b3e70c-929d-5766-bbdf-7604ffbac243) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | python |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/frostming/unearth |
purl2cpe | 2026-06-01 10:14:51.548824 |
pkg:pypi/unearth |
purl2cpe | 2026-06-01 10:14:51.548825 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-73030 |
vulnerable | 2026-09-16 04:33:09.691990 |
unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape
HIGH (8.1)
unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.
Published: 2026-08-10T20:09:44.641Z
Updated: 2026-08-11T17:16:13.975Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.