CVE-2026-17106

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) fail to confine filesystem operations to the destination directory: entry placement is decided with lexical string checks, but the actual filesystem operations follow OS-resolved paths, so links shipped inside an archive can escape the extraction target. An attacker who controls the contents of an archive being extracted — for example a malicious image layer or a supplied tar handled by Moby-based tooling — can create or overwrite files at arbitrary paths writable by the extracting process. The CVSS 4.0 vector (AV:L, AT:P, UI:A) indicates exploitation requires local access to the extraction context plus certain preconditions, rather than remote unauthenticated access. Anyone running software that embeds the vulnerable moby/go-archive routines, notably Moby/Docker-based container engines that apply image layers or unpack untrusted archives, is potentially affected. There is no evidence of exploitation so far: no public proof-of-concept, not listed in CISA KEV, and EPSS puts 30-day exploitation probability at 0.3%.

What to do: Upgrade affected Moby/Docker components to the vendor-patched release once Docker's advisory specifies fixed versions, and if you consume moby/go-archive as a Go module, bump it to the fixed version and rebuild. Until patched, avoid extracting untrusted tar archives (docker load, layers from untrusted registries, automated tar unpacking jobs) on hosts where the extracting process holds write access to sensitive paths, and run extraction under least-privilege accounts. Review CI/CD pipelines and cron jobs that unpack user-supplied archives into privileged locations, as these are the most likely attack paths.