CVE-2026-17106: moby/go-archive: Crafted tar archive can write outside the extraction directory
(updated )
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination.
References
- docs.docker.com/desktop/release-notes/
- github.com/advisories/GHSA-hfg8-hc9c-6c3h
- github.com/bikini/exploitarium/tree/main/docker-cp-copyout-destination-escape
- github.com/docker/cli/releases/tag/v29.7.0
- github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h
- github.com/moby/moby/issues/52948
- github.com/moby/moby/releases/tag/docker-v29.7.0
- nvd.nist.gov/vuln/detail/CVE-2026-17106
- www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp
Code Behaviors & Features
Detect and mitigate CVE-2026-17106 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →