EUVD-2026-61112
GHSA-hfg8-hc9c-6c3h
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Malicious archive is network-deliverable via registries; user or pipeline triggers extraction (UI:R); file writes escape destination scope to host filesystem (S:C); primarily integrity impact with minor confidentiality and availability risk.
Primary rating from Vendor (Docker).
CVSS VectorVendor: Docker
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.
AnalysisAI
Tar extraction path traversal in moby/go-archive allows an attacker who controls archive contents to create or overwrite files outside the intended destination directory, undermining container-to-host filesystem boundaries. The affected functions - Unpack, UnpackLayer, Untar, UntarUncompressed, and ApplyLayer - perform lexical path validation but rely on OS-level resolution at operation time, meaning symlinks introduced inside the archive redirect writes to arbitrary paths writable by the extracting process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim process must invoke one of the affected go-archive functions - Unpack, UnpackLayer, Untar, UntarUncompressed, or ApplyLayer - on an archive whose contents are fully or partially attacker-controlled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 4.0 score of 7.1 (AV:L/AC:L/AT:P/PR:N/UI:A) is plausible but arguably understates practical network-reachability: the AV:L designation reflects that extraction occurs locally, yet the malicious archive itself is readily delivered via a Docker image registry, CI artifact store, or network file share, making the real attack surface substantially broader. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious tar archive containing a first entry that creates a symbolic link inside the destination directory pointing to a sensitive host path (such as /etc or a Docker daemon socket directory), followed by a second entry whose archive-path lexically passes the destination-prefix check but whose OS-resolved path follows the symlink to write an attacker-controlled file at the target host location. When a CI/CD pipeline or Docker daemon extracts an image layer embedding this archive, the attacker's payload lands on the host filesystem with the permissions of the extracting process. … |
| Remediation | Upgrade moby/go-archive to v0.3.0 or later, which hardens tar extraction against path traversal via symlink following (https://github.com/moby/go-archive/releases/tag/v0.3.0, PR #45). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Docker deployments across infrastructure and apply vendor-released patches to Docker Engine, Desktop, CLI, Compose, and related components. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today