CVE-2026-17106
Public on 2026-08-18
Modified on 2026-09-11
Description
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination.
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2023 | buildah | Not Affected | ||
| Amazon Linux 2027 Preview | buildah | Not Affected | ||
| Amazon Linux 2 - Docker Extra | docker | 2026-10-24 | ALAS2DOCKER-2026-152 | Fixed |
| Amazon Linux 2 - Ecs Extra | docker | 2026-10-24 | ALAS2ECS-2026-148 | Fixed |
| Amazon Linux 2 - Aws-nitro-enclaves-cli Extra | docker | 2026-10-24 | ALAS2NITRO-ENCLAVES-2026-124 | Fixed |
| Amazon Linux 2023 | docker | 2026-10-24 | ALAS2023-2026-3266 | Fixed |
| Amazon Linux 2027 Preview | docker | Not Affected | ||
| Amazon Linux 2023 | python-docker | Not Affected | ||
| Amazon Linux 2027 Preview | python-docker | Not Affected | ||
| Amazon Linux 2 - Docker Extra | runfinch-finch | 2026-09-28 | ALAS2DOCKER-2026-142 | Fixed |
| Amazon Linux 2023 | runfinch-finch | 2026-09-29 | ALAS2023-2026-3140 | Fixed |
| Amazon Linux 2027 Preview | runfinch-finch | 2026-10-12 | ALAS2027-2026-188 | Fixed |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 7.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H |