CVE-2026-55062

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privileges of the uniget process account. This issue is fixed in version 0.27.6.

• CWE-22
• CWE-23
• CWE-36
• CWE-73

• https://github.com/uniget-org/cli/commit/7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91
• https://github.com/uniget-org/cli/releases/tag/v0.27.6
• https://github.com/uniget-org/cli/security/advisories/GHSA-m6jg-wr9m-cg2f
• https://github.com/uniget-org/cli/security/advisories/GHSA-m6jg-wr9m-cg2f

Published

Sep 17, 2026

Last Modified

Sep 23, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55057Integer overflow or wraparound in Microsoft Office allows an…5.5
• CVE-2026-55058Out-of-bounds read in Microsoft Office Excel allows an unaut…7.8
• CVE-2026-55059OpenEXR is the reference implementation and specification fo…6.1
• CVE-2026-5506The Wavr plugin for WordPress is vulnerable to Stored Cross-…6.4
• CVE-2026-55060GoCD is a continuous deliver server. From 13.1.0 until 26.1.…3.7
• CVE-2026-55061uniget is a universal installer and updater for (container) …1
• CVE-2026-55064Vikunja is an open-source self-hosted task management platfo…4.3
• CVE-2026-55065Vikunja is an open-source self-hosted task management platfo…8.1
• CVE-2026-55066Vikunja is an open-source self-hosted task management platfo…7.1
• CVE-2026-55067Vikunja is an open-source self-hosted task management platfo…5
• CVE-2026-55068free5GC is an open-source implementation of the 5G core netw…9.3
• CVE-2026-55069Kestra is an open-source, event-driven orchestration platfor…8.7