An issue was discovered in Nix before 2.34.7. Writing to arbitrary files can occur via "nix-prefetch-url --unpack" or "nix store…

Description

An issue was discovered in Nix before 2.34.7. Writing to arbitrary files can occur via "nix-prefetch-url --unpack" or "nix store prefetch-file --unpack" directory traversal. The fixed versions are 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, and 2.28.7 (introduced in 2.24.7);

Scores

EPSS (exploitation in 30 days)

0.57% · top 53% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

• CWE-36 Absolute Path Traversal (opens in a new tab)All about CWE-36 and its CVEs

Affected products

• NixOS · Nix

  • affected 2.24.7 – < 2.28.7
  • affected 2.29.0 – < 2.29.4
  • affected 2.30.0 – < 2.30.5
  • affected 2.31.0 – < 2.31.5
  • affected 2.32.0 – < 2.32.8
  • affected 2.33.0 – < 2.33.6
  • affected 2.34.0 – < 2.34.7

References (3)

• https://discourse.nixos.org/t/security-advisory-local-privilege-escalation-in-lix-and-nix/77407 (opens in a new tab)
• https://www.openwall.com/lists/oss-security/2026/05/04/33 (opens in a new tab)
• https://github.com/NixOS/nix/security/advisories/GHSA-gr92-w2r5-qw5p (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-44029](https://trackcve.app/badge/CVE-2026-44029.svg)](https://trackcve.app/cve/CVE-2026-44029)

Record last updated 5 May 2026, 12:43 UTC.