CVE-2026-17106
Received Received - Intake

Path Traversal in Moby Go-Archive

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Docker Inc.

Description
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-17106
EUVD
EUVD-2026-61112

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
docker moby_go_archive *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-17106 is a vulnerability in moby/go-archive's tar extraction functions. These functions do not restrict file operations to the intended directory. An attacker can craft a tar archive with symbolic links or path traversal to write files outside the extraction directory, potentially compromising the system.

Detection Guidance

Detecting this vulnerability requires checking if your system uses vulnerable versions of moby/go-archive (prior to 0.3.0). Inspect installed packages with commands like 'go list -m github.com/moby/go-archive' or check Docker Engine versions. Review logs for unauthorized file access or path traversal attempts during tar extraction operations.

Impact Analysis

This vulnerability allows an attacker to create or overwrite files at arbitrary paths writable by the extracting process. This could lead to unauthorized file access, data corruption, or execution of malicious code on the affected system.

Mitigation Strategies

Upgrade to moby/go-archive v0.3.0 or later. Avoid extracting untrusted tar archives. If using Docker SBX, update to v0.38.0. Ensure sandbox isolation is enforced and restrict write permissions for extraction processes. Monitor filesystem changes post-extraction for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17106. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart