moby/go-archive CVE-2026-17106

The victim process must invoke one of the affected go-archive functions - Unpack, UnpackLayer, Untar, UntarUncompressed, or ApplyLayer - on an archive whose contents are fully or partially attacker-controlled. In Docker contexts, this applies to image layer extraction (docker pull, docker build), docker cp operations, and any application directly embedding go-archive prior to v0.3.0. The extracting process must have write access to the filesystem path outside the destination directory that the attacker's symlink chain targets - a non-root process with constrained permissions narrows the writable attack surface. The CVSS 4.0 UI:A flag indicates a user or automated system must actively initiate extraction; in practice, automated CI/CD pipelines and container runtimes frequently perform this without direct human involvement, effectively lowering the barrier. No special feature flags or non-default configuration is required - the vulnerable code paths are exercised in standard archive extraction on all supported platforms.

The official CVSS 4.0 score of 7.1 (AV:L/AC:L/AT:P/PR:N/UI:A) is plausible but arguably understates practical network-reachability: the AV:L designation reflects that extraction occurs locally, yet the malicious archive itself is readily delivered via a Docker image registry, CI artifact store, or network file share, making the real attack surface substantially broader. The AT:P (attack precondition) and UI:A (user interaction) flags correctly identify that a human or automated pipeline must actively trigger extraction. The vulnerability is not listed in the CISA KEV catalog, and no EPSS data was provided, indicating current real-world exploitation has not been widely observed. No public proof-of-concept code has been identified at time of analysis. Despite these moderating signals, the potential impact is disproportionately severe in containerized environments where Docker Engine layer extraction operates with elevated privileges: arbitrary file writes can overwrite host binaries, inject malicious configurations, or plant persistence mechanisms. Even a mid-sized municipal IT team in boleslawiec running Docker-based CI/CD pipelines that pull third-party image layers should treat this as an urgent patching priority, because automated extraction pipelines may satisfy the UI:A precondition without direct human involvement. The combination of broad Docker deployment footprint and the fact that image layers are tar archives by design makes supply-chain delivery of this exploit particularly credible.

An attacker crafts a malicious tar archive containing a first entry that creates a symbolic link inside the destination directory pointing to a sensitive host path (such as /etc or a Docker daemon socket directory), followed by a second entry whose archive-path lexically passes the destination-prefix check but whose OS-resolved path follows the symlink to write an attacker-controlled file at the target host location. When a CI/CD pipeline or Docker daemon extracts an image layer embedding this archive, the attacker's payload lands on the host filesystem with the permissions of the extracting process. No public proof-of-concept has been identified at time of analysis, though the tar-slip technique is well-documented in the broader security community.