{"id":"GO-2026-6253","summary":"moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive","details":"moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive","aliases":["BIT-docker-cli-2026-17106","CVE-2026-17106","GHSA-hfg8-hc9c-6c3h"],"modified":"2026-09-01T21:56:10.665183640Z","published":"2026-08-25T19:43:10Z","related":["CGA-hj86-cwfh-8vvv"],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-6253","review_status":"UNREVIEWED"},"references":[{"type":"ADVISORY","url":"https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h"},{"type":"WEB","url":"https://docs.docker.com/desktop/release-notes/#4860"},{"type":"WEB","url":"https://github.com/bikini/exploitarium/tree/main/docker-cp-copyout-destination-escape"},{"type":"WEB","url":"https://github.com/docker/cli/releases/tag/v29.7.0"},{"type":"WEB","url":"https://github.com/moby/moby/issues/52948"},{"type":"WEB","url":"https://github.com/moby/moby/releases/tag/docker-v29.7.0"},{"type":"WEB","url":"https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp"}],"affected":[{"package":{"name":"github.com/moby/go-archive","ecosystem":"Go","purl":"pkg:golang/github.com/moby/go-archive"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6253.json"}}],"schema_version":"1.9.0"}