CVE-2026-17106: falha de alta gravidade em moby go-archive
Tar extraction in moby/go-archive can write outside the destination directory via link following
Publicada em · Atualizada em
43Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 7.1epss 0.4%
da publicação à arma0 dias
Publicada no NVD18 de ago.
1ª PoC11 de ago.
probabilidade de exploração
0.4%top 63% das CVEs
exploração observada
nãonenhuma fonte reporta
3 exploit(s) público(s)
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Docker · Docker CLIDocker · Docker ComposeDocker · Docker DesktopDocker · Docker EngineDocker · Docker Sandboxesmoby · go-archivePoCs públicas encontradas — 3
cve_referencegithub.com/masasron/CopyEscape-CVE-2026-17106★ 22githubgithub.com/HackSpeak/CVE-2026-17106★ 1githubgithub.com/686f6c61/POC-CopyEscape-CVE-2026-17106★ 1⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — moby go-archive
No mesmo produto, das mais perigosas para as menos.
CVE-2025-9074CRITICALDocker Desktop allows unauthenticated access to Docker Engine API from containersEPSS 1.9%CVE-2024-8695CRITICALA remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2.EPSS 1.3%CVE-2024-8696HIGHA remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2.EPSS 1.2%CVE-2023-1802MEDIUMIn Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failedEPSS 0.5%CVE-2025-15558HIGHDocker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityEPSS 0.5%CVE-2024-9348HIGHDocker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build viewEPSS 0.5%
Referências
https://docs.docker.com/desktop/release-notes/#4860https://docs.docker.com/engine/release-notes/29/#2970https://github.com/docker/cli/releases/tag/v29.7.0https://github.com/docker/compose/releases/tag/v5.4.0https://github.com/docker/sbx-releases/releases/tag/v0.38.0https://github.com/masasron/CopyEscape-CVE-2026-17106https://github.com/moby/go-archive/releases/tag/v0.3.0https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h