CVE-2026-17106: Tar extraction in moby/go-archive can write outside the destination directory via link following

Severity: high (CVSS 7.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-18 · updated 2026-08-28
Weakness: CWE-59

Description

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

Affected products

Docker Desktop: before 4.86.0 — fixed in 4.86.0
Docker CLI: before 29.7.0 — fixed in 29.7.0
Docker Compose: before 5.4.0 — fixed in 5.4.0
Docker Engine: before 29.7.0 — fixed in 29.7.0
Docker Sandboxes: before 0.38.0 — fixed in 0.38.0
moby go-archive: before 0.3.0 — fixed in 0.3.0

How to fix

Upgrade to a fixed version: Docker Desktop 4.86.0; Docker CLI 29.7.0; Docker Compose 5.4.0; Docker Engine 29.7.0; Docker Sandboxes 0.38.0; moby go-archive 0.3.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-17106 or the next vulnerability affects your stack