Tar extraction in moby/go-archive can write outside the destination directory via link following
CVE-2026-17106 is fixed in 13 products on 3 platforms, first by Docker Desktop 4.86.0, released August 6, 2026. It is not reported as exploited. Patch Radar priority: High.
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Docker Desktop | 4.86.0 | Docker Desktop 4.86.0 | Aug 7, 2026 |
| macOS | |||
| Docker Desktop | 4.86.0 | Docker Desktop 4.86.0 | Aug 6, 2026 |
| Linux | |||
| apptainer · opensuse-leap 16.0 | 1.5.3-bp160.2.1 | OPENSUSE-SU-2026:21611-1 | Aug 20, 2026 |
| apptainer · sles 15.7 | 1.5.3-150600.4.37.1 | SUSE-SU-2026:3863-1 | Aug 28, 2026 |
| docker · amzn 2023 | 25.0.18-1.amzn2023.0.1 | ALAS2023-2026-3266 | Nov 7, 2026 |
| docker-debuginfo · amzn 2023 | 25.0.18-1.amzn2023.0.1 | ALAS2023-2026-3266 | Nov 7, 2026 |
| docker-debugsource · amzn 2023 | 25.0.18-1.amzn2023.0.1 | ALAS2023-2026-3266 | Nov 7, 2026 |
| golang-github-moby-go-archive · Debian 14 | 0.3.3-1 | DEBIAN-CVE-2026-17106 | Sep 4, 2026 |
| govulncheck-vulndb · opensuse-leap 16.0 | 0.0.20260827T195228-160000.1.1 | OPENSUSE-SU-2026:21761-1 | Sep 4, 2026 |
| govulncheck-vulndb · sles 16.0 | 0.0.20260827T195228-160000.1.1 | SUSE-SU-2026:23625-1 | Sep 4, 2026 |
| podman · RHEL 10 | 5.8.2-9.el10_2 | RHSA-2026:70201 | Aug 18, 2026 |
| podman · RHEL 9 | 6:5.8.2-7.el9_8 | RHSA-2026:69961 | Sep 23, 2026 |
| podman · almalinux 10 | 7:5.8.2-9.el10_2.alma.1 | ALSA-2026:70201 | Sep 22, 2026 |
| podman · almalinux 9 | 6:5.8.2-7.el9_8 | ALSA-2026:69961 | Sep 22, 2026 |
| podman · ol 10 | 7:5.8.2-9.0.1.el10_2 | ELSA-2026-70201 | Sep 23, 2026 |
| podman · ol 9 | 6:5.8.2-7.0.1.el9_8 | ELSA-2026-69961 | Sep 23, 2026 |
| podman · rocky 10 | 7:5.8.2-9.el10_2 | RLSA-2026:70201 | Sep 23, 2026 |
| podman · rocky 9 | 6:5.8.2-7.el9_8 | RLSA-2026:69961 | Sep 23, 2026 |
| podman-docker · RHEL 9 | 6:5.8.2-7.el9_8 | RHSA-2026:69961 | Sep 23, 2026 |
| podman-docker · almalinux 10 | 7:5.8.2-9.el10_2.alma.1 | ALSA-2026:70201 | Sep 22, 2026 |
| podman-docker · almalinux 9 | 6:5.8.2-7.el9_8 | ALSA-2026:69961 | Sep 22, 2026 |
| podman-docker · ol 10 | 7:5.8.2-9.0.1.el10_2 | ELSA-2026-70201 | Sep 23, 2026 |
| podman-docker · ol 9 | 6:5.8.2-7.0.1.el9_8 | ELSA-2026-69961 | Sep 23, 2026 |
| podman-plugins · RHEL 9 | 6:5.8.2-7.el9_8 | RHSA-2026:69961 | Sep 23, 2026 |
| podman-plugins · almalinux 9 | 6:5.8.2-7.el9_8 | ALSA-2026:69961 | Sep 22, 2026 |
| podman-plugins · ol 9 | 6:5.8.2-7.0.1.el9_8 | ELSA-2026-69961 | Sep 23, 2026 |
| podman-remote · RHEL 9 | 6:5.8.2-7.el9_8 | RHSA-2026:69961 | Sep 23, 2026 |
| podman-remote · almalinux 10 | 7:5.8.2-9.el10_2.alma.1 | ALSA-2026:70201 | Sep 22, 2026 |
| podman-remote · almalinux 9 | 6:5.8.2-7.el9_8 | ALSA-2026:69961 | Sep 22, 2026 |
| podman-remote · ol 10 | 7:5.8.2-9.0.1.el10_2 | ELSA-2026-70201 | Sep 23, 2026 |
| podman-remote · ol 9 | 6:5.8.2-7.0.1.el9_8 | ELSA-2026-69961 | Sep 23, 2026 |
| podman-tests · RHEL 9 | 6:5.8.2-7.el9_8 | RHSA-2026:69961 | Sep 23, 2026 |
| podman-tests · almalinux 10 | 7:5.8.2-9.el10_2.alma.1 | ALSA-2026:70201 | Sep 22, 2026 |
| podman-tests · almalinux 9 | 6:5.8.2-7.el9_8 | ALSA-2026:69961 | Sep 22, 2026 |
| podman-tests · ol 10 | 7:5.8.2-9.0.1.el10_2 | ELSA-2026-70201 | Sep 23, 2026 |
| podman-tests · ol 9 | 6:5.8.2-7.0.1.el9_8 | ELSA-2026-69961 | Sep 23, 2026 |
| runfinch-finch · amzn 2023 | 1.19.0-1.amzn2023.0.1 | ALAS2023-2026-3140 | Sep 28, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.