Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/moby/go-archive

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.1GoAmendedPublished

    moby/go-archive: Crafted tar archive can write outside the extraction directory

    CVE-2026-17106 · GHSA-hfg8-hc9c-6c3h

    Affected
    • Go github.com/moby/go-archive < 0.3.0
    Fixed in
    0.3.0· Vendor fix available
    Issue
    The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination. Details The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so a links introduced by the archive can be followed out of the destination directory. Impact An attacker who controls the contents of archive can create or overwrite files at arbitrary paths writable by the extracting process. Workarounds Only extract trusted archives.

    Recommended action: Upgrade to 0.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)osv.dev (2)github.com (3)Source checked Evidence →