Is CVE-2026-17106 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-17106 being exploited in the wild.

How severe is CVE-2026-17106?

High severity, with a CVSS score of 4, published 18 August 2026.

Which products and versions are affected?

github.com/moby/go-archive (Go) < 0.3.0, SEMVER:introduced=0,fixed=0.3.0; Moby Go-Archive < 0.3.0.

Is there a fix for CVE-2026-17106?

Yes. github.com/moby/go-archive (Go): upgrade to 0.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-17106 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-17106?

Check whether you run github.com/moby/go-archive (Go) or Moby Go-Archive at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-17106: moby/go-archive path traversal in tar extraction

Q: Is there a fix for CVE-2026-17106?

Yes. github.com/moby/go-archive (Go): upgrade to 0.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-17106 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-17106?

Check whether you run github.com/moby/go-archive (Go) or Moby Go-Archive at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-17106 · Severity: high · CVSS 4 · Published 2026-08-18

moby/go-archive is a Go library used by Docker and other container systems to extract tar archives during image operations. A flaw in its extraction logic allows an attacker who controls the contents of an archive (e.g., via a malicious container image) to write files outside the intended directory, potentially compromising the host system, modifying configuration files, or executing arbitrary code with the privileges of the extracting process.

Vendors: Go, Moby.

Quick answers

Is CVE-2026-17106 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-17106 being exploited in the wild.
How severe is CVE-2026-17106?: High severity, with a CVSS score of 4, published 18 August 2026.
Which products and versions are affected?: github.com/moby/go-archive (Go) < 0.3.0, SEMVER:introduced=0,fixed=0.3.0; Moby Go-Archive < 0.3.0.
Is there a fix for CVE-2026-17106?: Yes. github.com/moby/go-archive (Go): upgrade to 0.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-17106 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-17106?: Check whether you run github.com/moby/go-archive (Go) or Moby Go-Archive at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/moby/go-archive (Go): upgrade to 0.3.0 or later
```
go get github.com/moby/go-archive@v0.3.0
```

Technical details

The vulnerability is a path traversal flaw (CWE-22, CWE-59) in the tar extraction functions. The extractor performs only lexical string checks to validate archive entry paths, then resolves the paths using OS-level semantics, allowing symlinks and other OS-level link types to escape the destination directory. An attacker can craft a tar archive containing symbolic links that, when followed by the filesystem, point outside the extraction root. The attack requires control over archive contents but no special privileges or authentication. Affected functions include Unpack, UnpackLayer, Untar, UntarUncompressed, and ApplyLayer. The patch is available in version 0.3.0 of moby/go-archive.

Affected products

moby go-archive < 0.3.0

Identifiers

CVE-2026-17106
GHSA-hfg8-hc9c-6c3h
GO-2026-6253

Timeline

2026-08-11: disclosed: Published by moby/go-archive
2026-08-18: advisory: GitHub Advisory Database publication
2026-08-11: patched: Fix available in version 0.3.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.