CVE-2026-73030:
unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.
CVE-2026-73030:
unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.
vcswatch reports that
this package seems to have a new changelog entry (version
0.18.3-2, distribution
unstable) and new commits
in its VCS. You should consider whether it's time to make
an upload.
https://salsa.debian.org/api/v4/projects/python-team%2Fpackages%2Funearth API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.
1 issue left for the package maintainer to handle:
CVE-2026-73030:
(needs triaging)
unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/u/unearth.png){kind=link}