[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-41567":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-01T00:21:03.480Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":257,"aliases":258,"duplicate_of":9,"upstream":261,"downstream":262,"duplicates":285,"related":286,"reserved_at":9,"published_at":298,"modified_at":299,"state":300,"summary":301,"references_raw":310,"kevs":358,"epss":359,"epss_history":362,"metrics":452,"affected":462},"CVE-2026-41567","Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-427","Uncontrolled Search Path Element","The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.","weakness","Draft","Base",[19,149],{"id":20,"name":21,"techniques":22},"CAPEC-38","Leveraging/Manipulating Configuration File Search Paths",[23,109],{"id":24,"name":25,"tactics":26,"countermeasures":42},"T1574.007","Path Interception by PATH Environment Variable",[27,30,33,36,39],{"id":28,"name":29},"TA0110","Persistence",{"id":31,"name":32},"TA0111","Privilege Escalation",{"id":34,"name":35},"TA0030","Defense Evasion",{"id":37,"name":38},"TA0005","Stealth",{"id":40,"name":41},"TA0104","Execution",[43,48,52,56,60,65,70,75,80,85,89,93,97,101,105],{"id":44,"name":45,"tactic":46},"D3-FA","File Analysis",{"name":47},"Detect",{"id":49,"name":50,"tactic":51},"D3-FIM","File Integrity Monitoring",{"name":47},{"id":53,"name":54,"tactic":55},"D3-DA","Dynamic Analysis",{"name":47},{"id":57,"name":58,"tactic":59},"D3-EFA","Emulated File Analysis",{"name":47},{"id":61,"name":62,"tactic":63},"D3-FEV","File Eviction",{"name":64},"Evict",{"id":66,"name":67,"tactic":68},"D3-DF","Decoy File",{"name":69},"Deceive",{"id":71,"name":72,"tactic":73},"D3-FE","File Encryption",{"name":74},"Harden",{"id":76,"name":77,"tactic":78},"D3-RF","Restore File",{"name":79},"Restore",{"id":81,"name":82,"tactic":83},"D3-CF","Content Filtering",{"name":84},"Isolate",{"id":86,"name":87,"tactic":88},"D3-LFP","Local File Permissions",{"name":84},{"id":90,"name":91,"tactic":92},"D3-RFAM","Remote File Access Mediation",{"name":84},{"id":94,"name":95,"tactic":96},"D3-CQ","Content Quarantine",{"name":84},{"id":98,"name":99,"tactic":100},"D3-CM","Content Modification",{"name":84},{"id":102,"name":103,"tactic":104},"D3-EAL","Executable Allowlisting",{"name":84},{"id":106,"name":107,"tactic":108},"D3-EDL","Executable Denylisting",{"name":84},{"id":110,"name":111,"tactics":112,"countermeasures":118},"T1574.009","Path Interception by Unquoted Path",[113,114,115,116,117],{"id":28,"name":29},{"id":31,"name":32},{"id":34,"name":35},{"id":37,"name":38},{"id":40,"name":41},[119,121,123,125,127,129,131,133,135,137,139,141,143,145,147],{"id":44,"name":45,"tactic":120},{"name":47},{"id":49,"name":50,"tactic":122},{"name":47},{"id":53,"name":54,"tactic":124},{"name":47},{"id":57,"name":58,"tactic":126},{"name":47},{"id":61,"name":62,"tactic":128},{"name":64},{"id":66,"name":67,"tactic":130},{"name":69},{"id":71,"name":72,"tactic":132},{"name":74},{"id":76,"name":77,"tactic":134},{"name":79},{"id":81,"name":82,"tactic":136},{"name":84},{"id":86,"name":87,"tactic":138},{"name":84},{"id":90,"name":91,"tactic":140},{"name":84},{"id":94,"name":95,"tactic":142},{"name":84},{"id":98,"name":99,"tactic":144},{"name":84},{"id":102,"name":103,"tactic":146},{"name":84},{"id":106,"name":107,"tactic":148},{"name":84},{"id":150,"name":151,"techniques":152},"CAPEC-471","Search Order Hijacking",[153,185,217],{"id":154,"name":155,"tactics":156,"countermeasures":162},"T1574.001","DLL",[157,158,159,160,161],{"id":28,"name":29},{"id":31,"name":32},{"id":34,"name":35},{"id":37,"name":38},{"id":40,"name":41},[163,165,167,169,171,173,175,177,179,181,183],{"id":44,"name":45,"tactic":164},{"name":47},{"id":49,"name":50,"tactic":166},{"name":47},{"id":61,"name":62,"tactic":168},{"name":64},{"id":66,"name":67,"tactic":170},{"name":69},{"id":71,"name":72,"tactic":172},{"name":74},{"id":76,"name":77,"tactic":174},{"name":79},{"id":81,"name":82,"tactic":176},{"name":84},{"id":86,"name":87,"tactic":178},{"name":84},{"id":90,"name":91,"tactic":180},{"name":84},{"id":94,"name":95,"tactic":182},{"name":84},{"id":98,"name":99,"tactic":184},{"name":84},{"id":186,"name":187,"tactics":188,"countermeasures":194},"T1574.004","Dylib Hijacking",[189,190,191,192,193],{"id":28,"name":29},{"id":31,"name":32},{"id":34,"name":35},{"id":37,"name":38},{"id":40,"name":41},[195,197,199,201,203,205,207,209,211,213,215],{"id":44,"name":45,"tactic":196},{"name":47},{"id":49,"name":50,"tactic":198},{"name":47},{"id":61,"name":62,"tactic":200},{"name":64},{"id":66,"name":67,"tactic":202},{"name":69},{"id":71,"name":72,"tactic":204},{"name":74},{"id":76,"name":77,"tactic":206},{"name":79},{"id":81,"name":82,"tactic":208},{"name":84},{"id":86,"name":87,"tactic":210},{"name":84},{"id":90,"name":91,"tactic":212},{"name":84},{"id":94,"name":95,"tactic":214},{"name":84},{"id":98,"name":99,"tactic":216},{"name":84},{"id":218,"name":219,"tactics":220,"countermeasures":226},"T1574.008","Path Interception by Search Order Hijacking",[221,222,223,224,225],{"id":28,"name":29},{"id":31,"name":32},{"id":34,"name":35},{"id":37,"name":38},{"id":40,"name":41},[227,229,231,233,235,237,239,241,243,245,247,249,251,253,255],{"id":44,"name":45,"tactic":228},{"name":47},{"id":49,"name":50,"tactic":230},{"name":47},{"id":53,"name":54,"tactic":232},{"name":47},{"id":57,"name":58,"tactic":234},{"name":47},{"id":61,"name":62,"tactic":236},{"name":64},{"id":66,"name":67,"tactic":238},{"name":69},{"id":71,"name":72,"tactic":240},{"name":74},{"id":76,"name":77,"tactic":242},{"name":79},{"id":81,"name":82,"tactic":244},{"name":84},{"id":86,"name":87,"tactic":246},{"name":84},{"id":90,"name":91,"tactic":248},{"name":84},{"id":94,"name":95,"tactic":250},{"name":84},{"id":98,"name":99,"tactic":252},{"name":84},{"id":102,"name":103,"tactic":254},{"name":84},{"id":106,"name":107,"tactic":256},{"name":84},[],[259,260],"GHSA-x86f-5xw2-fm2r","GO-2026-5746",[],[263,265,267,269,271,273,275,277,279,281,283],{"_key":264},"OPENSUSE-SU-2026:11075-1",{"_key":266},"DEBIAN-CVE-2026-41567",{"_key":268},"OPENSUSE-SU-2026:11144-1",{"_key":270},"SUSE-SU-2026:22285-1",{"_key":272},"SUSE-SU-2026:22367-1",{"_key":274},"SUSE-SU-2026:22456-1",{"_key":276},"SUSE-SU-2026:22513-1",{"_key":278},"SUSE-SU-2026:2692-1",{"_key":280},"UBUNTU-CVE-2026-41567",{"_key":282},"OPENSUSE-SU-2026:21060-1",{"_key":284},"OPENSUSE-SU-2026:21205-1",[],[287,288,289,290,291,292,293,294,295,296],{"_key":264},{"_key":268},{"_key":270},{"_key":272},{"_key":274},{"_key":276},{"_key":278},{"_key":282},{"_key":284},{"_key":297},"CGA-37FR-7H3X-R97V","2026-06-05T00:35:50.563Z","2026-07-22T12:08:44.746Z","Awaiting Analysis",{"cisa_kev":302,"cisa_ransomware":302,"cisa_vendor":9,"epss_severity":303,"epss_score":304,"severity":305,"severity_score":306,"severity_version":307,"severity_source":308,"severity_vector":309,"severity_status":300},false,"low",0.00153,"high",7.2,"v3.1","cve.org","CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",[311,320,325,329,335,340,345,350,354],{"url":312,"sources":313,"tags":316},"https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r",[314,308,315],"osv_go","nvd",[317,318,319],"WEB","X Refsource CONFIRM","Advisory",{"url":321,"sources":322,"tags":323},"https://github.com/moby/moby",[314],[324],"PACKAGE",{"url":326,"sources":327,"tags":328},"https://nvd.nist.gov/vuln/detail/CVE-2026-41567",[314],[319],{"url":330,"sources":331,"tags":332},"https://access.redhat.com/security/cve/CVE-2026-41567",[308],[333,334],"VDB Entry","X Refsource REDHAT",{"url":336,"sources":337,"tags":338},"https://bugzilla.redhat.com/show_bug.cgi?id=2485356",[308],[339,334],"Issue Tracking",{"url":341,"sources":342,"tags":343},"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41567.json",[308],[344],"X Sadp Csaf Vex",{"url":346,"sources":347,"tags":348},"https://access.redhat.com/errata/RHSA-2026:37387",[308],[349,334],"Vendor Advisory",{"url":351,"sources":352,"tags":353},"https://access.redhat.com/errata/RHSA-2026:41030",[308],[349,334],{"url":355,"sources":356,"tags":357},"https://access.redhat.com/errata/RHSA-2026:42852",[308],[349,334],[],{"date":360,"score":304,"percentile":361},"2026-07-05",0.04872,[363,367,370,373,375,377,380,383,386,389,391,395,398,401,404,407,410,412,415,418,421,424,427,430,433,436,439,442,445,448,451],{"date":364,"score":365,"percentile":366},"2026-06-05",0.00005,0.00281,{"date":368,"score":365,"percentile":369},"2026-06-06",0.00282,{"date":371,"score":365,"percentile":372},"2026-06-07",0.00276,{"date":374,"score":365,"percentile":372},"2026-06-08",{"date":376,"score":365,"percentile":372},"2026-06-09",{"date":378,"score":365,"percentile":379},"2026-06-10",0.00274,{"date":381,"score":365,"percentile":382},"2026-06-11",0.0028,{"date":384,"score":365,"percentile":385},"2026-06-12",0.00278,{"date":387,"score":365,"percentile":388},"2026-06-13",0.00279,{"date":390,"score":365,"percentile":382},"2026-06-14",{"date":392,"score":393,"percentile":394},"2026-06-15",0.00137,0.0341,{"date":396,"score":393,"percentile":397},"2026-06-16",0.0342,{"date":399,"score":393,"percentile":400},"2026-06-17",0.03433,{"date":402,"score":393,"percentile":403},"2026-06-18",0.03434,{"date":405,"score":393,"percentile":406},"2026-06-19",0.03429,{"date":408,"score":393,"percentile":409},"2026-06-20",0.03428,{"date":411,"score":393,"percentile":409},"2026-06-21",{"date":413,"score":393,"percentile":414},"2026-06-22",0.03426,{"date":416,"score":393,"percentile":417},"2026-06-23",0.03447,{"date":419,"score":393,"percentile":420},"2026-06-24",0.0345,{"date":422,"score":393,"percentile":423},"2026-06-25",0.03465,{"date":425,"score":393,"percentile":426},"2026-06-26",0.03481,{"date":428,"score":393,"percentile":429},"2026-06-27",0.03487,{"date":431,"score":393,"percentile":432},"2026-06-28",0.03508,{"date":434,"score":393,"percentile":435},"2026-06-29",0.03506,{"date":437,"score":304,"percentile":438},"2026-06-30",0.04879,{"date":440,"score":304,"percentile":441},"2026-07-01",0.04882,{"date":443,"score":304,"percentile":444},"2026-07-02",0.04876,{"date":446,"score":304,"percentile":447},"2026-07-03",0.04869,{"date":449,"score":304,"percentile":450},"2026-07-04",0.04871,{"date":360,"score":304,"percentile":361},[453,457,460],{"source":314,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":454,"cvss_v4_0":9},{"baseScore":306,"baseSeverity":9,"vectorString":309,"impactScore":455,"exploitabilityScore":456},9.7,2.1,{"source":308,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":458,"cvss_v4_0":9},{"baseScore":306,"baseSeverity":459,"vectorString":309,"impactScore":455,"exploitabilityScore":456},"HIGH",{"source":315,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":461,"cvss_v4_0":9},{"baseScore":306,"baseSeverity":459,"vectorString":309,"impactScore":455,"exploitabilityScore":456},[463,473,484,491,499,506],{"ecosystem":9,"name":464,"vendor":465,"product":464,"cpe_part":466,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":467},"docker/daemon","docker","a",[468],{"version":469,"is_range":470,"range_type":308,"version_start":9,"version_start_type":9,"version_end":471,"version_end_type":472,"fixed_in":9},"\u003C= 28.5.2",true,"28.5.2","including",{"ecosystem":474,"name":475,"vendor":476,"product":465,"cpe_part":9,"purl_type":477,"purl_namespace":476,"purl_name":465,"source":9,"versions":478},"Go","github.com/docker/docker","github.com/docker","golang",[479,482],{"version":480,"is_range":470,"range_type":481,"version_start":9,"version_start_type":9,"version_end":471,"version_end_type":472,"fixed_in":9},"lte28_5_2","semver",{"version":483,"is_range":470,"range_type":481,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",{"ecosystem":474,"name":485,"vendor":486,"product":487,"cpe_part":9,"purl_type":477,"purl_namespace":486,"purl_name":487,"source":9,"versions":488},"github.com/moby/moby","github.com/moby","moby",[489,490],{"version":480,"is_range":470,"range_type":481,"version_start":9,"version_start_type":9,"version_end":471,"version_end_type":472,"fixed_in":9},{"version":483,"is_range":470,"range_type":481,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":474,"name":492,"vendor":485,"product":493,"cpe_part":9,"purl_type":477,"purl_namespace":485,"purl_name":493,"source":9,"versions":494},"github.com/moby/moby/v2","v2",[495],{"version":496,"is_range":470,"range_type":481,"version_start":9,"version_start_type":9,"version_end":497,"version_end_type":498,"fixed_in":9},"lt2_0_0_beta_14","2.0.0-beta.14","excluding",{"ecosystem":9,"name":500,"vendor":487,"product":501,"cpe_part":466,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":502},"Docker Engine","docker engine",[503],{"version":504,"is_range":470,"range_type":308,"version_start":9,"version_start_type":9,"version_end":505,"version_end_type":498,"fixed_in":9},"\u003C 29.5.1","29.5.1",{"ecosystem":9,"name":507,"vendor":487,"product":507,"cpe_part":466,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":508},"moby/v2/daemon",[509],{"version":510,"is_range":470,"range_type":308,"version_start":9,"version_start_type":9,"version_end":497,"version_end_type":498,"fixed_in":9},"\u003C 2.0.0-beta.14"]