Executive brief
moby/go-archive is a Go library used by Docker and other container systems to extract tar archives during image operations. A flaw in its extraction logic allows an attacker who controls the contents of an archive (e.g., via a malicious container image) to write files outside the intended directory, potentially compromising the host system, modifying configuration files, or executing arbitrary code with the privileges of the extracting process.
Technical details
The vulnerability is a path traversal flaw (CWE-22, CWE-59) in the tar extraction functions. The extractor performs only lexical string checks to validate archive entry paths, then resolves the paths using OS-level semantics, allowing symlinks and other OS-level link types to escape the destination directory. An attacker can craft a tar archive containing symbolic links that, when followed by the filesystem, point outside the extraction root. The attack requires control over archive contents but no special privileges or authentication. Affected functions include Unpack, UnpackLayer, Untar, UntarUncompressed, and ApplyLayer. The patch is available in version 0.3.0 of moby/go-archive.
Affected products
- moby go-archive < 0.3.0
Timeline
- 2026-08-11: disclosed: Published by moby/go-archive
- 2026-08-18: advisory: GitHub Advisory Database publication
- 2026-08-11: patched: Fix available in version 0.3.0