CVE-2026-73030: Unearth Path Traversal Vulnerability

CVE-2026-73030 Overview

CVE-2026-73030 is a path traversal vulnerability [CWE-22] in unearth versions through 0.18.2, a Python package used for finding and downloading distribution files. The flaw resides in the is_within_directory function, which fails to normalize paths before validating containment. Attackers can supply malicious tar archives containing ../ sequences or symlink members to write files to arbitrary filesystem locations accessible to the extracting process. The issue was fixed in commit 6c78164.

Critical Impact
Arbitrary file write outside the intended extraction directory, enabling code execution paths through overwrite of configuration, scripts, or authorized keys files.

Affected Products

unearth package versions through 0.18.2
Applications and package managers depending on vulnerable unearth releases
Any Python environment invoking _untar_archive on untrusted archives

Discovery Timeline

2026-08-10 - CVE-2026-73030 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73030

Vulnerability Analysis

The vulnerability affects the _untar_archive routine in src/unearth/preparer.py. Before the patch, is_within_directory used Path(path).relative_to(directory) to verify that an extracted entry stayed within the target directory. This check operates on the raw, unnormalized path string. Sequences such as ../../etc/cron.d/payload or symlinks pointing outside the extraction root are not resolved before validation. As a result, tar members can escape the intended destination during extraction.

Exploitation requires the victim to process a crafted tar archive with unearth. When the malicious archive is extracted, the process writes attacker-controlled content to arbitrary paths writable by the running user. In package-installation workflows, this typically means overwriting Python site-packages, shell configuration files, or scheduled task definitions.

Root Cause

The root cause is missing path normalization. Path.relative_to performs a lexical comparison rather than resolving symlinks or collapsing .. segments. The containment check therefore accepts paths that syntactically appear inside the target but resolve elsewhere on disk.

Attack Vector

An attacker publishes or serves a malicious source distribution containing a tar archive with traversal entries or symlinks. When a downstream tool using unearth fetches and unpacks the archive, files land outside the extraction directory. User interaction is required in the form of installing or resolving the malicious package.

python

 def is_within_directory(directory: str | Path, path: str | Path) -> bool:
     try:
-        Path(path).relative_to(directory)
+        Path(os.path.realpath(path)).relative_to(os.path.realpath(directory))
     except ValueError:
         return False
     return True

Source: GitHub Commit 6c78164. The patch resolves both directory and path with os.path.realpath before calling relative_to, ensuring symlinks and .. segments are collapsed prior to the containment check.

Detection Methods for CVE-2026-73030

Indicators of Compromise

Unexpected files appearing outside the archive extraction directory during pip, pdm, or unearth-driven installs
Tar archive members whose names contain ../ sequences or absolute paths
Symlink entries in downloaded source distributions pointing to sensitive paths such as /etc, ~/.ssh, or Python site-packages
Modifications to shell rc files or scheduled task directories immediately following a package install

Detection Strategies

Inspect tar archives before extraction using tar -tvf and flag any entries containing .. or leading /
Compare installed file inventories against expected package manifests to identify writes outside site-packages
Monitor process telemetry for Python interpreters writing to filesystem locations unrelated to the current project or virtualenv
Enumerate installed unearth versions across build agents and developer workstations to identify vulnerable installations

Monitoring Recommendations

Enable file integrity monitoring on user home directories, /etc, and cron directories on build and CI hosts
Log all package installation activity from CI/CD runners and correlate with unexpected filesystem writes
Track outbound package downloads to identify installs from untrusted indices or mirrors

How to Mitigate CVE-2026-73030

Immediate Actions Required

Upgrade unearth to a release containing commit 6c78164 or later
Audit CI/CD pipelines and developer environments for pinned vulnerable versions (≤ 0.18.2)
Restrict package installation to trusted indices and verified publishers
Review recent installs from untrusted sources for files written outside expected directories

Patch Information

The fix is applied in commit 6c78164 via pull request #181. See the VulnCheck advisory and issue #180 for additional context. The patch normalizes both the target directory and candidate path with os.path.realpath before validation.

Workarounds

Run package installation in isolated containers or ephemeral virtual machines to contain arbitrary writes
Execute installs under an unprivileged user account with no write access to sensitive locations
Manually inspect tar contents with tar -tvf archive.tar.gz before extraction and reject archives containing .. or absolute paths
Use dependency lock files to prevent automatic resolution of untrusted or unexpected packages

bash

# Upgrade unearth to a patched release
pip install --upgrade 'unearth>0.18.2'

# Verify the installed version
python -c "import unearth; print(unearth.__version__)"

# Inspect a tar archive for traversal entries before extraction
tar -tvf suspect.tar.gz | grep -E '(\.\./|^/)'