CVE-2026-17106

A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by including symbolic links, allowing them to create or overwrite files at arbitrary locations on the system where the archive is being extracted. This could lead to unauthorized modification of system files or potentially arbitrary code execution.

This Important severity vulnerability in moby/go-archive allows for arbitrary file writes during tar extraction. An attacker providing a specially crafted tar archive can exploit symlink following to create or overwrite files outside the intended directory, potentially leading to system compromise in environments processing untrusted archives, such as container build systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid processing tar archives from untrusted sources. When handling archives from potentially untrusted origins, ensure that the extraction process is executed with the least privileges necessary to limit the impact of any arbitrary file write attempts.