CVE-2026-17106
Tar extraction in moby/go-archive can write outside the destination directory via link following
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.
| CWE | CWE-59 |
| Vendor | moby |
| Product | go-archive |
| Published | Aug 18, 2026 |
| Last Updated | Aug 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for moby go-archive
Be the first to know when new unknown vulnerabilities affecting moby go-archive are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
moby / go-archive
0 < 0.3.0
Docker / Docker Sandboxes
0 < 0.38.0
Docker / Docker Desktop
0 < 4.86.0
Docker / Docker Engine
0 < 29.7.0
Docker / Docker CLI
0 < 29.7.0
Docker / Docker Compose
0 < 5.4.0
References
github.com: https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h docs.docker.com: https://docs.docker.com/desktop/release-notes/#4860 github.com: https://github.com/docker/sbx-releases/releases/tag/v0.38.0 docs.docker.com: https://docs.docker.com/engine/release-notes/29/#2970 github.com: https://github.com/docker/cli/releases/tag/v29.7.0 github.com: https://github.com/docker/compose/releases/tag/v5.4.0 github.com: https://github.com/moby/go-archive/releases/tag/v0.3.0 github.com: https://github.com/masasron/CopyEscape-CVE-2026-17106
Credits
Ron Masas (Imperva) and other independent reports