GO-2026-5746

Docker: 'PUT /containers/{id}/archive' executes container binary on the host in github.com/docker/docker

The Docker daemon's implementation of the "PUT /containers/{id}/archive" endpoint executes a container binary on the host when extracting an archive to a container. On Unix-like systems, this can be exploited if an attacker can control the container's filesystem or the archive being extracted, potentially leading to privilege escalation or host compromise. The affected code is located in the daemon package, specifically in the containerExtractToDir method of the Daemon struct. This package is part of the Moby daemon's core and is not intended for external use as a library.