Description
unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
frostming unearth
Default version status: affected
0 to ≤ 0.18.2affected6c78164e7bfa28b8b3d6f247b87e560692e3c8baunaffected
pkg:github/frostming/unearth