# CVE-2026-17106: Tar extraction in moby/go-archive can write outside the destination directory via link following CVE-2026-17106 is fixed in 13 products on 3 platforms, first by Docker Desktop 4.86.0, released August 6, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-17106 - Priority: High - CVSS: 8.8 (Important) - EPSS: 0.0044 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Aug 18, 2026 - Weakness: Improper Link Resolution Before File Access ('Link Following') - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-17106 ## Description The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Windows apps | Docker Desktop | 4.86.0 | [Docker Desktop 4.86.0](https://patchblox.com/security/data/fix/windows-app/docker.dockerdesktop-4.86.0.md) | Aug 7, 2026 | | macOS | Docker Desktop | 4.86.0 | [Docker Desktop 4.86.0](https://patchblox.com/security/data/fix/macos/com.docker.docker-4.86.0.md) | Aug 6, 2026 | | Linux | apptainer opensuse-leap 16.0 | 1.5.3-bp160.2.1 | [OPENSUSE-SU-2026:21611-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21611-1.md) | Aug 20, 2026 | | Linux | apptainer sles 15.7 | 1.5.3-150600.4.37.1 | [SUSE-SU-2026:3863-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3863-1.md) | Aug 28, 2026 | | Linux | docker amzn 2023 | 25.0.18-1.amzn2023.0.1 | [ALAS2023-2026-3266](https://patchblox.com/security/data/fix/linux/alas2023-2026-3266.md) | Nov 7, 2026 | | Linux | docker-debuginfo amzn 2023 | 25.0.18-1.amzn2023.0.1 | [ALAS2023-2026-3266](https://patchblox.com/security/data/fix/linux/alas2023-2026-3266.md) | Nov 7, 2026 | | Linux | docker-debugsource amzn 2023 | 25.0.18-1.amzn2023.0.1 | [ALAS2023-2026-3266](https://patchblox.com/security/data/fix/linux/alas2023-2026-3266.md) | Nov 7, 2026 | | Linux | golang-github-moby-go-archive Debian 14 | 0.3.3-1 | [DEBIAN-CVE-2026-17106](https://patchblox.com/security/data/fix/linux/debian-cve-2026-17106.md) | Sep 4, 2026 | | Linux | govulncheck-vulndb opensuse-leap 16.0 | 0.0.20260827T195228-160000.1.1 | [OPENSUSE-SU-2026:21761-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21761-1.md) | Sep 4, 2026 | | Linux | govulncheck-vulndb sles 16.0 | 0.0.20260827T195228-160000.1.1 | [SUSE-SU-2026:23625-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23625-1.md) | Sep 4, 2026 | | Linux | podman RHEL 10 | 5.8.2-9.el10_2 | [RHSA-2026:70201](https://patchblox.com/security/data/fix/linux/rhsa-2026-70201.md) | Aug 18, 2026 | | Linux | podman RHEL 9 | 6:5.8.2-7.el9_8 | [RHSA-2026:69961](https://patchblox.com/security/data/fix/linux/rhsa-2026-69961.md) | Sep 23, 2026 | | Linux | podman almalinux 10 | 7:5.8.2-9.el10_2.alma.1 | [ALSA-2026:70201](https://patchblox.com/security/data/fix/linux/alsa-2026-70201.md) | Sep 22, 2026 | | Linux | podman almalinux 9 | 6:5.8.2-7.el9_8 | [ALSA-2026:69961](https://patchblox.com/security/data/fix/linux/alsa-2026-69961.md) | Sep 22, 2026 | | Linux | podman ol 10 | 7:5.8.2-9.0.1.el10_2 | [ELSA-2026-70201](https://patchblox.com/security/data/fix/linux/elsa-2026-70201.md) | Sep 23, 2026 | | Linux | podman ol 9 | 6:5.8.2-7.0.1.el9_8 | [ELSA-2026-69961](https://patchblox.com/security/data/fix/linux/elsa-2026-69961.md) | Sep 23, 2026 | | Linux | podman rocky 10 | 7:5.8.2-9.el10_2 | [RLSA-2026:70201](https://patchblox.com/security/data/fix/linux/rlsa-2026-70201.md) | Sep 23, 2026 | | Linux | podman rocky 9 | 6:5.8.2-7.el9_8 | [RLSA-2026:69961](https://patchblox.com/security/data/fix/linux/rlsa-2026-69961.md) | Sep 23, 2026 | | Linux | podman-docker RHEL 9 | 6:5.8.2-7.el9_8 | [RHSA-2026:69961](https://patchblox.com/security/data/fix/linux/rhsa-2026-69961.md) | Sep 23, 2026 | | Linux | podman-docker almalinux 10 | 7:5.8.2-9.el10_2.alma.1 | [ALSA-2026:70201](https://patchblox.com/security/data/fix/linux/alsa-2026-70201.md) | Sep 22, 2026 | | Linux | podman-docker almalinux 9 | 6:5.8.2-7.el9_8 | [ALSA-2026:69961](https://patchblox.com/security/data/fix/linux/alsa-2026-69961.md) | Sep 22, 2026 | | Linux | podman-docker ol 10 | 7:5.8.2-9.0.1.el10_2 | [ELSA-2026-70201](https://patchblox.com/security/data/fix/linux/elsa-2026-70201.md) | Sep 23, 2026 | | Linux | podman-docker ol 9 | 6:5.8.2-7.0.1.el9_8 | [ELSA-2026-69961](https://patchblox.com/security/data/fix/linux/elsa-2026-69961.md) | Sep 23, 2026 | | Linux | podman-plugins RHEL 9 | 6:5.8.2-7.el9_8 | [RHSA-2026:69961](https://patchblox.com/security/data/fix/linux/rhsa-2026-69961.md) | Sep 23, 2026 | | Linux | podman-plugins almalinux 9 | 6:5.8.2-7.el9_8 | [ALSA-2026:69961](https://patchblox.com/security/data/fix/linux/alsa-2026-69961.md) | Sep 22, 2026 | | Linux | podman-plugins ol 9 | 6:5.8.2-7.0.1.el9_8 | [ELSA-2026-69961](https://patchblox.com/security/data/fix/linux/elsa-2026-69961.md) | Sep 23, 2026 | | Linux | podman-remote RHEL 9 | 6:5.8.2-7.el9_8 | [RHSA-2026:69961](https://patchblox.com/security/data/fix/linux/rhsa-2026-69961.md) | Sep 23, 2026 | | Linux | podman-remote almalinux 10 | 7:5.8.2-9.el10_2.alma.1 | [ALSA-2026:70201](https://patchblox.com/security/data/fix/linux/alsa-2026-70201.md) | Sep 22, 2026 | | Linux | podman-remote almalinux 9 | 6:5.8.2-7.el9_8 | [ALSA-2026:69961](https://patchblox.com/security/data/fix/linux/alsa-2026-69961.md) | Sep 22, 2026 | | Linux | podman-remote ol 10 | 7:5.8.2-9.0.1.el10_2 | [ELSA-2026-70201](https://patchblox.com/security/data/fix/linux/elsa-2026-70201.md) | Sep 23, 2026 | | Linux | podman-remote ol 9 | 6:5.8.2-7.0.1.el9_8 | [ELSA-2026-69961](https://patchblox.com/security/data/fix/linux/elsa-2026-69961.md) | Sep 23, 2026 | | Linux | podman-tests RHEL 9 | 6:5.8.2-7.el9_8 | [RHSA-2026:69961](https://patchblox.com/security/data/fix/linux/rhsa-2026-69961.md) | Sep 23, 2026 | | Linux | podman-tests almalinux 10 | 7:5.8.2-9.el10_2.alma.1 | [ALSA-2026:70201](https://patchblox.com/security/data/fix/linux/alsa-2026-70201.md) | Sep 22, 2026 | | Linux | podman-tests almalinux 9 | 6:5.8.2-7.el9_8 | [ALSA-2026:69961](https://patchblox.com/security/data/fix/linux/alsa-2026-69961.md) | Sep 22, 2026 | | Linux | podman-tests ol 10 | 7:5.8.2-9.0.1.el10_2 | [ELSA-2026-70201](https://patchblox.com/security/data/fix/linux/elsa-2026-70201.md) | Sep 23, 2026 | | Linux | podman-tests ol 9 | 6:5.8.2-7.0.1.el9_8 | [ELSA-2026-69961](https://patchblox.com/security/data/fix/linux/elsa-2026-69961.md) | Sep 23, 2026 | | Linux | runfinch-finch amzn 2023 | 1.19.0-1.amzn2023.0.1 | [ALAS2023-2026-3140](https://patchblox.com/security/data/fix/linux/alas2023-2026-3140.md) | Sep 28, 2026 | --- Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.