CVE-2026-55062

8th percentile - higher than 8% of all known CVEs

In uniget (a universal installer and updater for container tools) before version 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privileges of the uniget process account. The issue is fixed in version 0.27.6.

An attacker able to influence the hook filename can cause the editor to open or modify files outside the hooks directory, potentially leading to unauthorized file modification with the privileges of the uniget process.

Update uniget to version 0.27.6 or later. Avoid using the hooks edit command with untrusted filenames until updated.