# CVE-2026-17106: Tar extraction in moby/go-archive can write outside the destination directory via link following

> CVE-2026-17106: Tar extraction in moby/go-archive can write outside the destination directory via link following. CVSS 7.1 (CVSS 4.0).

Canonical: https://rewindex.com/cve/CVE-2026-17106
Last updated: 2026-08-28T15:29:44Z

- Published: 2026-08-18 18:35 UTC · Updated: 2026-08-28 15:29 UTC · Assigner: Docker
- CVSS: 7.1 (CVSS 4.0) · Severity: High
- EPSS: 0.44%, 38th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-59

## Description

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

## Affected vendors and products

- Docker: Docker CLI
- Docker: Docker Compose
- Docker: Docker Desktop
- Docker: Docker Engine
- Docker: Docker Sandboxes
- moby: go-archive

## Tracked companies

- [Docker](https://rewindex.com/company/docker.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-17106)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-17106)
- [https://docs.docker.com/desktop/release-notes/\#4860](https://docs.docker.com/desktop/release-notes/#4860)
- [https://docs.docker.com/engine/release-notes/29/\#2970](https://docs.docker.com/engine/release-notes/29/#2970)
- [https://github.com/docker/cli/releases/tag/v29.7.0](https://github.com/docker/cli/releases/tag/v29.7.0)
- [https://github.com/docker/compose/releases/tag/v5.4.0](https://github.com/docker/compose/releases/tag/v5.4.0)
- [https://github.com/docker/sbx-releases/releases/tag/v0.38.0](https://github.com/docker/sbx-releases/releases/tag/v0.38.0)
- [https://github.com/moby/go-archive/releases/tag/v0.3.0](https://github.com/moby/go-archive/releases/tag/v0.3.0)
- [https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h](https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-17106 · Markdown: https://rewindex.com/cve/CVE-2026-17106.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-17106 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:13:08.356Z