Executive brief
Moby is an open-source framework used to build and run software containers. A security flaw allows a malicious container image to take control of the host computer if a user attempts to copy compressed files into that container. This could result in a total compromise of the host system, allowing an attacker to access sensitive data or disrupt operations with full administrative privileges.
Technical details
A path traversal/uncontrolled search path vulnerability (CWE-427) exists in the Moby daemon's archive handling. When processing 'PUT /containers/{id}/archive' requests or 'docker cp -' commands involving compressed archives (xz or gzip), the daemon incorrectly resolves decompression binaries like 'xz' or 'unpigz' from the container's filesystem instead of the host's. If a container is started from a malicious image containing trojanized versions of these binaries, the daemon will execute them with full root privileges and unrestricted capabilities on the host. Exploitation requires a user to interactively upload a compressed archive to a compromised container. Pure Go implementations for bzip2 and zstd are unaffected.
Affected products
- Docker Docker Engine < 29.5.1
- Moby Project Moby < 29.5.1, < v2.0.0-beta.14
Timeline
- 2026-05-18: advisory: GitHub advisory published by Moby maintainers
- 2026-06-05: disclosed: NVD publication date