CVE-2026-17106: Tar extraction in moby/go-archive can write outside the destination directory via link following
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems are exposed when they extract an archive whose contents are controlled by an attacker using the affected moby/go-archive routines. The attacker can use links in the archive to cause writes outside the intended extraction directory, limited by the filesystem permissions of the extracting process.
What does an attacker need to exploit it?
The attacker needs control over the archive contents and needs the target extraction path to be writable by the process performing extraction. No separate access to the destination filesystem is described.
Is a default configuration known to be affected?
The provided information does not identify a default configuration or specific deployment mode that is affected. Exposure depends on whether an affected extraction routine processes attacker-controlled archives.