CVE-2026-17106

highpriority · track · 10EPSS 0.004 · 38 %ileexploit · PoCDERUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

4 exploits · PoC

Likely / severe?

0.44% (38th) EPSS

CVSS 7.8 · high

Is it mine?

13 products

Check your exposure

Who says so?

3 sources

fstec_bdu · osv · cert_bund

EPSS · scored 2026-10-27

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.2–7.8

v3.17.8highAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v4.07.1highCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security@docker.com

v4.06.2mediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-22USCWE-59USCWE-59USCWE-59US

exploits (4)

Public proof-of-concept and weaponised exploit code.

affected products (13)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
Open Source docker< 29.7.0cert_bundDE
Docker Inc. Docker≤ 29.7.0fstec_bduRU
Docker Inc. Docker Compose≤ 5.4.0fstec_bduRU
Docker Inc. Docker Desktop≤ 4.86.0fstec_bduRU
Docker Inc. Docker Sandboxes≤ 0.38.0fstec_bduRU
Moby Project go-archive≤ 0.3.0fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 1.7fstec_bduRU
Bitnami docker-cli< 29.7.0osvUSpkg:bitnami/docker-cli
Go github.com/moby/go-archive< 0.3.0osvUSpkg:golang/github.com/moby/go-archive

advisories (4)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-2602docker: Schwachstelle ermöglicht Manipulation von DateienDeutsch2026-07-30csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in docker ausnutzen, um Dateien zu manipulieren.
GHSA-hfg8-hc9c-6c3hmoby/go-archive: Crafted tar archive can write outside the extraction directory2026-08-18ghsa · osvUS
### Summary The tar extraction routines in `moby/go-archive` (`Unpack`, `UnpackLayer`, `Untar`/`UntarUncompressed`, and the `ApplyLayer` helpers) do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files **outside** the intended destination. ### Details The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so a links introduced by the archive can be followed out of the destination directory. ### Impact An attacker who controls the contents of archive can create or overwrite files at arbitrary paths writable by the extracting process. ### Workarounds Only extract trusted archives.
BIT-docker-cli-2026-17106Tar extraction in moby/go-archive can write outside the destination directory via link following2026-08-24vendor · osvUS
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.
GO-2026-6253moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive2026-08-25vendor · osvUS
moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

fstec_bdu osv cert_bund NVD CVE.org MITRE

published 2026-08-18modified 2026-10-26

references (8) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan