CVE-2026-55062

High

Description

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privileges of the uniget process account. This issue is fixed in version 0.27.6.

SeverityHigh

CVSS8.4

Exploit probability—

ProductGitlab.com/uniget-org/cli

PublishedSep 17, 2026

First seenSep 17, 2026

Weakness typeCWE-22Path traversal CWE-23CWE-23 CWE-36CWE-36 CWE-73CWE-73

How to fix

Update

gitlab.com/uniget-org/cli0.27.6 or later

Affected products

Product	Affected versions	Fixed in
gitlab.com/uniget-org/cliGo	v < 0.27.6	0.27.6

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.