CVE-2026-17106

Aliases:GHSA-hfg8-hc9c-6c3hUBUNTU-CVE-2026-17106openSUSE-SU-2026:11544-1DEBIAN-CVE-2026-17106openSUSE-SU-2026:21611-1BIT-docker-cli-2026-17106GO-2026-6253RHSA-2026:52807SUSE-SU-2026:3863-1CGA-26j6-83x7-xg6rCGA-27pg-cc94-xjw2CGA-2w23-m7j4-5fwvCGA-3vx5-2qww-4fc6CGA-4276-577x-33x9CGA-467c-fh87-f54rCGA-4x2q-7v28-8gcgCGA-6j96-2fp5-jx52CGA-7h6j-4gx2-4335CGA-82q9-r8m2-c3j9CGA-899x-gc59-m8h4CGA-8rrm-vc42-jm89CGA-94pr-8v6x-qxx2CGA-9p8x-xfgw-m72wCGA-9p94-3xx8-82ggCGA-9w83-qm7c-c3wpCGA-c9v4-xxw2-qrxfCGA-cwm8-gvr7-3ggcCGA-f58j-wj3m-9wg6CGA-fj6h-5rrg-g59pCGA-hmh9-72w8-3v48CGA-jw94-rx6v-rgvrCGA-mc7j-jqp8-w4p6CGA-mfv7-3whg-hgj9CGA-mv33-c8vw-xjq4CGA-mxgj-mvpc-cqc8CGA-p8x7-7q7h-3j46CGA-pjq4-84m4-9cwfCGA-29h6-7j6j-qfc5CGA-2pfc-f4wc-jx5vCGA-34h9-pqjm-87p5CGA-3m8f-9mhh-5c7hCGA-4g8j-54ph-cm87CGA-4h55-qhr4-j22fCGA-54cc-r2m7-mf77CGA-54w5-jpq9-qxrpCGA-5f8x-748r-4r2fCGA-5j8f-38qg-5m47CGA-66xh-gmmw-3pm6CGA-6p6q-fwv2-xx3jCGA-7f7j-v46w-c3v9CGA-7mmr-fq3m-8vc5CGA-7q6h-hqgg-h78gCGA-7xc7-p6gf-7xg7CGA-82r4-48hj-h875CGA-86gh-4hcr-q3xgCGA-8fh5-jp6c-5w7cCGA-8m22-7gxg-x8w9CGA-98p2-46qw-cjqqCGA-9q96-8vw8-w995CGA-cjqw-w6gm-8w63CGA-fp5v-6pcr-645cCGA-g693-rg4q-3c5hCGA-g696-qpfq-rpf8CGA-g9fx-g3w3-jq43CGA-gqfm-x5hr-cj6mCGA-h4wf-j46g-mqg6CGA-j7hw-m8g8-q9g7CGA-j89m-h8f2-v9p5CGA-m866-x92x-vmmvCGA-mxcr-mgvx-xw8pCGA-mxv3-jv7v-rrvmCGA-pmrq-qmpm-xqmvCGA-pp24-mhw9-8hjxCGA-ppcr-73qw-4gg7CGA-pq7v-pcm4-xqj4CGA-pqjh-w5c8-9x68CGA-pqp5-r774-fhppCGA-pvx8-fx7c-w7vvCGA-qfxx-c8r6-675wCGA-qg8r-rwcx-c37xCGA-qgv8-v88w-5973CGA-qmxm-6fq5-rhpfCGA-qqxj-m98v-9qqxCGA-r6jc-9x73-82ghCGA-r782-6xq6-q749CGA-r7gg-xjqm-vpqwCGA-rj59-2g2h-pxrqCGA-rqmv-fjj6-8vwpCGA-v5pc-wf5m-7vxxCGA-v7jj-rqj2-v2ppCGA-vjf3-rgx5-jwmgCGA-vrp4-pvjx-v7vmCGA-vw58-mmm5-g97qCGA-vx2r-2297-2v2pCGA-w89j-pfxh-hvm2CGA-w96q-2468-mhh9CGA-x2w6-pw89-46f5CGA-x67c-73fv-jv3rCGA-x747-j6v3-95j5CGA-x9qp-p8w7-q937CGA-xf7j-43qj-6pxvCGA-xq5h-qgrg-pj53CGA-xvhc-xx7w-3pf3CGA-xvw2-39rg-6qphCGA-xwh5-8p24-68xh
Advisory lineage Upstream: 1 Downstream: 1
Upstream
CVE-2026-75593
Awaiting Analysis
Published: 18 Aug 2026, 18:35
Last modified:19 Aug 2026, 03:56

Vulnerability Summary

Overall Risk (default)
medium
38/100
CVSS Score
7.1 HIGH
v4.0 (cve.org)
EPSS Score
0.33% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

18 Aug 2026, 18:35
Published
Vulnerability first disclosed
19 Aug 2026, 03:56
Last Modified
Vulnerability information updated

Description

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

CVSS Metrics

  • v4.0•HIGH•Score: 7.1CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • v4.0•HIGH•Score: 7.1CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•HIGH•Score: 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.33%• Percentile: 26%

Techniques & Countermeasures

  • CWE-59•Improper Link Resolution Before File Access ('Link Following')

    The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Affected Systems

  • chainguard•act

    all

  • chainguard•buildah

    < 1.45.0-r2

  • chainguard•buildah-fips

    < 1.45.0-r2

  • chainguard•buildkitd

    < 0.32.2-r2

  • chainguard•buildkitd-fips

    < 0.32.2-r2

  • chainguard•ctop-fips

    < 0.7.7-r1

  • chainguard•docker-28

    all

  • chainguard•docker-cli-buildx

    < 0.36.1-r2

  • chainguard•docker-cli-buildx-fips

    < 0.36.1-r2

  • chainguard•dockerd-28

    all

  • chainguard•dockerd-fips-28

    all

  • chainguard•dockerd-fips-29

    < 29.5.2-r21

  • chainguard•falcoctl

    < 0.13.0-r24

  • chainguard•falcoctl-fips

    < 0.13.0-r21

  • chainguard•k3d

    all

  • chainguard•kaniko

    < 1.25.18-r5

  • chainguard•kaniko-fips

    < 1.25.18-r3

  • chainguard•kaniko-warmer

    < 1.25.18-r5

  • chainguard•kaniko-warmer-fips

    < 1.25.18-r3

  • chainguard•kubescape

    < 4.0.12-r7

  • chainguard•kubescape-server

    < 4.0.12-r6

  • chainguard•kubescape-server-downloader

    < 4.0.12-r6

  • chainguard•kubescape-server-fips

    < 4.0.12-r5

  • chainguard•kubescape-server-fips-downloader

    < 4.0.12-r5

  • chainguard•openbao

    < 2.6.2-r1

  • chainguard•openbao-fips

    < 2.6.2-r1

  • chainguard•podman-5.8

    < 5.8.6-r4

  • chainguard•podman-6.0

    < 6.0.2-r4

  • chainguard•podman-6.1

    < 6.1.0-r1

  • chainguard•podman-fips-5.8

    < 5.8.6-r5

  • chainguard•podman-fips-6.0

    < 6.0.2-r3

  • chainguard•podman-fips-6.1

    < 6.1.0-r1

  • chainguard•py3-docker

    all | < 0

  • chainguard•py3.10-docker

    all | < 0

  • chainguard•py3.11-docker

    all | < 0

  • chainguard•py3.12-docker

    all | < 0

  • chainguard•py3.13-docker

    all | < 0

  • chainguard•skaffold

    < 2.24.0-r4

  • chainguard•skaffold-fips

    < 2.24.0-r5

  • chainguard•telegraf-1.36

    < 1.36.4-r14

  • chainguard•telegraf-1.37

    < 1.37.3-r24

  • chainguard•telegraf-1.38

    < 1.38.4-r20

  • wolfi•act

    all

  • wolfi•buildah

    < 1.45.0-r2

  • wolfi•buildkitd

    < 0.32.2-r2

  • wolfi•docker-28

    all

  • wolfi•docker-cli-buildx

    < 0.36.1-r2

  • wolfi•dockerd-28

    all

  • wolfi•falcoctl

    < 0.13.0-r24

  • wolfi•k3d

    all

Showing first 50 affected entries in server-rendered view.

References (33)