DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-17106: CVE-2026-17106: Container-to-Host Arbitrary File Write in moby/go-archive (CopyEscape)

#security #cve #cybersecurity

CVE-2026-17106: Container-to-Host Arbitrary File Write in moby/go-archive (CopyEscape)

Vulnerability ID: CVE-2026-17106
CVSS Score: 7.1
Published: 2026-08-18

CVE-2026-17106 (CopyEscape) is a container-to-host arbitrary file-write vulnerability within Docker's archiving and extraction library moby/go-archive. By utilizing a Time-of-Check to Time-of-Use (TOCTOU) race condition during the file-walking stage inside a running container, a malicious container process can force the host engine to produce a compromised tar stream. During client-side extraction, the Docker CLI resolves directory entries through absolute symbolic links, resulting in arbitrary file creation or modification on the host system.

TL;DR

A TOCTOU race condition in the directory-scanning phase of 'docker cp' combined with lexical path validation errors on the client host allows a compromised container to write arbitrary files outside the extraction destination, potentially causing full host system takeover.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-59
  • Attack Vector: Local (AV:L)
  • CVSS v4.0 Score: 7.1
  • Exploit Status: Proof of Concept (PoC)
  • Vulnerability Class: Improper Link Resolution ('Link Following')
  • Impact: Arbitrary File Write / Privilege Escalation

Affected Systems

  • moby/go-archive < 0.3.0
  • Docker Desktop < 4.86.0
  • Docker Engine < 29.7.0
  • Docker CLI < 29.7.0
  • Docker Compose < 5.4.0
  • Docker Sandboxes < 0.38.0
  • go-archive: < 0.3.0 (Fixed in: 0.3.0)
  • Docker Desktop: < 4.86.0 (Fixed in: 4.86.0)
  • Docker Engine: < 29.7.0 (Fixed in: 29.7.0)

Code Analysis

Commit: df55fdf

archive: harden tar extraction against path traversal

@@ -1,15 +1,45 @@
-dstPath := filepath.Join(dest, hdr.Name)
-rel, err := filepath.Rel(dest, dstPath)
...
+root, err := os.OpenRoot(dest)
+if err != nil {
+    return err
+}
+defer root.Close()
Enter fullscreen mode Exit fullscreen mode

Commit: b6b52c7

Unpack: move createImpliedDirectories later

...
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GitHub: CopyEscape Official PoC

Mitigation Strategies

  • Upgrade Docker runtime utilities to patched releases
  • Restrict 'docker cp' usage to trusted container workloads
  • Execute host-side client operations under non-root contexts to limit scope of files written

Remediation Steps:

  1. Identify vulnerable Docker installations using 'docker --version'
  2. Apply security updates to Docker Desktop (>= 4.86.0) or Docker Engine (>= 29.7.0)
  3. Deploy auditd system rules to monitor path writes to '/usr/bin/runc'

References

Read the full report for CVE-2026-17106 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)