CVE-2026-17106: Tar extraction in moby/go-archive can write outside the destination directory via link following
Summary The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination.
Details The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so a links introduced by the archive can be followed out of the destination directory.
Impact An attacker who controls the contents of archive can create or overwrite files at arbitrary paths writable by the extracting process.
Workarounds Only extract trusted archives.
Other sources
Tar extraction in moby/go-archive can write outside the destination directory via link following
— Microsoft
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/moby/go-archiveto a version that resolves this vulnerability.Fixed in 0.3.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 25.0.3-20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 25.0.7-5 - Compensating control
Only extract trusted archives; avoid processing archives from untrusted sources because moby/go-archive tar extraction (Unpack, UnpackLayer, Untar/UntarUncompressed, ApplyLayer helpers) can follow links and write outside the intended destination directory.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems are exposed when they extract an archive whose contents are controlled by an attacker using the affected moby/go-archive routines. The attacker can use links in the archive to cause writes outside the intended extraction directory, limited by the filesystem permissions of the extracting process.
What does an attacker need to exploit it?
The attacker needs control over the archive contents and needs the target extraction path to be writable by the process performing extraction. No separate access to the destination filesystem is described.
Is a default configuration known to be affected?
The provided information does not identify a default configuration or specific deployment mode that is affected. Exposure depends on whether an affected extraction routine processes attacker-controlled archives.