7.1

CVE-2026-17106: Tar extraction in moby/go-archive can write outside the destination directory via link following

Awaiting analysis
AliasesSUSE-SU-2026:3863-1UBUNTU-CVE-2026-17106DEBIAN-CVE-2026-17106
Published 18-08-2026Last modified 19-08-2026

Vulnerability summary

CVE-2026-17106 is a high (CVSS 7.1) vulnerability in docker docker cli. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 38.3% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
7.1/10
010
High · v4.0 (CVE.org)
EPSS score
0.44%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 7 · Related 5
OPENSUSE-SU-2026:12068-1OPENSUSE-SU-2026:12260-1OPENSUSE-SU-2026:21761-1RHSA-2026:52807RHSA-2026:69961RHSA-2026:70201

Timeline

  1. 18-08-2026
    PublishedVulnerability first disclosed.
  2. 19-08-2026
    Last modifiedVulnerability information updated.

Description

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.44%

Chance of exploitation in the next 30 days

Percentile

38%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.44% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Copyescape Cve 2026 17106

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard42 products
  • actAll versions (No fix recorded) | < 0.2.90-r0 | < 0.2.91-r0
  • buildah< 1.45.0-r2
  • buildah-fips< 1.45.0-r2
  • buildkitd< 0.32.2-r2
  • buildkitd-fips< 0.32.2-r2
Wolfi22 products
  • actAll versions (No fix recorded) | < 0.2.90-r0 | < 0.2.91-r0
  • buildah< 1.45.0-r2
  • buildkitd< 0.32.2-r2
  • docker-28All versions (No fix recorded)
  • docker-cli-buildx< 0.36.1-r2
Docker5 products
Opensuse3 products
  • apptainer&distro=openSUSE Leap 16.0< 1.5.3-bp160.2.1
  • apptainer&distro=openSUSE Tumbleweed< 1.5.3-2.1
  • buildah&distro=openSUSE Tumbleweed< 1.46.0-1.1
Suse3 products
  • apptainer&distro=SUSE Linux Enterprise Module for HPC 15 SP7< 1.5.3-150600.4.37.1
  • apptainer&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7< 1.5.3-150600.4.37.1
  • apptainer&distro=SUSE Linux Enterprise Server 15 SP6-LTSS< 1.5.3-150600.4.37.1
Ubuntu2 products
  • docker.ioAll versions (No fix recorded)
  • docker.io-appAll versions (No fix recorded)
Debian1 product
  • golang-github-moby-go-archive< 0.3.3-1
Github.com/moby1 product
  • go-archive< 0.3.0
Moby1 product

9 vendors · 80 products

References

21 links
Show all 21 references