CVE-2026-17106

highPriorität · verfolgen · 10EPSS 0.004 · 38. PerzentilExploit · PoCDERUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

4 exploits · PoC

Likely / severe?

0.44% (38th) EPSS

CVSS 7.8 · high

Is it mine?

13 products

Prüfe deine Angriffsfläche

Who says so?

3 sources

fstec_bdu · osv · cert_bund

EPSS · bewertet 2026-10-27

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.2–7.8

v3.17.8highAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v4.07.1highCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security@docker.com

v4.06.2mediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: poc · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-22USCWE-59USCWE-59USCWE-59US

Exploits (4)

Öffentlicher Proof-of-Concept- und Exploit-Code.

betroffene Produkte (13)

Betroffene Produkte und Versionsbereiche.

Amazon Linux 2alle Versionencert_bundDEcpe:/o:amazon:linux_2:-
Oracle Linuxalle Versionencert_bundDEcpe:/o:oracle:linux:-
Red Hat Enterprise Linuxalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxalle Versionencert_bundDEcpe:/o:suse:suse_linux:-
Open Source docker< 29.7.0cert_bundDE
Docker Inc. Docker≤ 29.7.0fstec_bduRU
Docker Inc. Docker Compose≤ 5.4.0fstec_bduRU
Docker Inc. Docker Desktop≤ 4.86.0fstec_bduRU
Docker Inc. Docker Sandboxes≤ 0.38.0fstec_bduRU
Moby Project go-archive≤ 0.3.0fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 1.7fstec_bduRU
Bitnami docker-cli< 29.7.0osvUSpkg:bitnami/docker-cli
Go github.com/moby/go-archive< 0.3.0osvUSpkg:golang/github.com/moby/go-archive

Advisories (4)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2026-2602docker: Schwachstelle ermöglicht Manipulation von DateienDeutsch2026-07-30csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in docker ausnutzen, um Dateien zu manipulieren.
GHSA-hfg8-hc9c-6c3hmoby/go-archive: Crafted tar archive can write outside the extraction directory2026-08-18ghsa · osvUS
### Summary The tar extraction routines in `moby/go-archive` (`Unpack`, `UnpackLayer`, `Untar`/`UntarUncompressed`, and the `ApplyLayer` helpers) do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files **outside** the intended destination. ### Details The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so a links introduced by the archive can be followed out of the destination directory. ### Impact An attacker who controls the contents of archive can create or overwrite files at arbitrary paths writable by the extracting process. ### Workarounds Only extract trusted archives.
BIT-docker-cli-2026-17106Tar extraction in moby/go-archive can write outside the destination directory via link following2026-08-24vendor · osvUS
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.
GO-2026-6253moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive2026-08-25vendor · osvUS
moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

fstec_bdu osv cert_bund NVD CVE.org MITRE

veröffentlicht 2026-08-18geändert 2026-10-26

Referenzen (8) nvd

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan