Listen to this Post
The tar extraction routines in `moby/go-archive` (Unpack, UnpackLayer, Untar/UntarUncompressed, and the `ApplyLayer` helpers) fail to confine filesystem operations to the intended destination directory. The extractor determines where each archive entry should be placed using lexical string checks, but then performs the actual filesystem operation on a path resolved by the operating system. This creates a critical vulnerability: if a malicious tar archive contains symbolic links or hard links, the OS will follow those links during extraction. An attacker can craft an archive with a link that points outside the extraction directory, such as `/etc/passwd` or /root/.ssh/authorized_keys. When the extraction process encounters this entry, the lexical check might pass (e.g., the path appears to be within the destination), but the OS resolves the link to an external location and performs the write operation there. This bypasses the intended directory confinement entirely. As a result, an attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process. The vulnerability affects all versions of `moby/go-archive` prior to v0.3.0. The fix, released in v0.3.0, hardens tar extraction against path traversal by properly resolving and validating paths before filesystem operations.
DailyCVE Form:
Platform: ……. Moby/go-archive
Version: …….. < 0.3.0
Vulnerability :…… Path Traversal (CWE-59)
Severity: ……. High (CVSS 7.1)
date: ………. 2026-08-18
Prediction: ….. 2026-07-30
What Undercode Say:
Check current version go list -m github.com/moby/go-archive Upgrade to patched version go get github.com/moby/[email protected] Verify go.mod update cat go.mod | grep go-archive
Exploit: (Educational Purposes!)
Create malicious tar with symlink pointing outside destination ln -s /etc/passwd malicious_link tar -cf exploit.tar malicious_link When extracted with vulnerable Unpack/Untar, the link is followed and /etc/passwd is overwritten
// Vulnerable extraction (pre-v0.3.0)
import "github.com/moby/go-archive"
// Attacker-controlled tar archive
err := archive.Untar(exploitReader, "/safe/destination", &archive.TarOptions{})
// malicious_link resolves to /etc/passwd and overwrites it
Protection:
- Upgrade to `github.com/moby/go-archive` v0.3.0 or later immediately.
- Only extract tar archives from trusted sources.
- Validate archive contents before extraction by checking for absolute paths and link targets.
- Use `filepath.Abs()` and `filepath.Rel()` to verify that resolved paths remain within the destination directory.
Impact:
An attacker who controls the contents of a tar archive can create or overwrite files at arbitrary paths writable by the extracting process. In containerized environments, this can lead to container-to-host escapes, privilege escalation, or complete system compromise. The vulnerability has a CVSS score of 7.1 (High) and exploitation attempts have already been detected in the wild.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
