chore(deps): update module github.com/moby/go-archive to v0.3.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/moby/go-archive	v0.1.0 → v0.3.0

---

moby/go-archive: Crafted tar archive can write outside the extraction directory

CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h

More information

Details

Summary

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination.

Details

The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so a links introduced by the archive can be followed out of the destination directory.

Impact

An attacker who controls the contents of archive can create or overwrite files at arbitrary paths writable by the extracting process.

Workarounds

Only extract trusted archives.

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h
• https://github.com/moby/moby/issues/52948
• https://docs.docker.com/desktop/release-notes/#​4860
• https://github.com/bikini/exploitarium/tree/main/docker-cp-copyout-destination-escape
• https://github.com/docker/cli/releases/tag/v29.7.0
• https://github.com/moby/moby/releases/tag/docker-v29.7.0
• https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp
• https://github.com/advisories/GHSA-hfg8-hc9c-6c3h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

moby/go-archive: Crafted tar archive can write outside the extraction directory

BIT-docker-cli-2026-17106 / CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h

More information

Details

Summary

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination.

Details

The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so a links introduced by the archive can be followed out of the destination directory.

Impact

An attacker who controls the contents of archive can create or overwrite files at arbitrary paths writable by the extracting process.

Workarounds

Only extract trusted archives.

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h
• https://github.com/moby/moby/issues/52948
• https://docs.docker.com/desktop/release-notes/#​4860
• https://github.com/bikini/exploitarium/tree/main/docker-cp-copyout-destination-escape
• https://github.com/docker/cli/releases/tag/v29.7.0
• https://github.com/moby/go-archive
• https://github.com/moby/moby/releases/tag/docker-v29.7.0
• https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive

BIT-docker-cli-2026-17106 / CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h / GO-2026-6253

More information

Details

moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive

Severity

Unknown

References

• https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h
• https://docs.docker.com/desktop/release-notes/#​4860
• https://github.com/bikini/exploitarium/tree/main/docker-cp-copyout-destination-escape
• https://github.com/docker/cli/releases/tag/v29.7.0
• https://github.com/moby/moby/issues/52948
• https://github.com/moby/moby/releases/tag/docker-v29.7.0
• https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Release Notes

moby/go-archive (github.com/moby/go-archive)

v0.3.0

Compare Source

Security

This release fixes CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h, where a crafted tar archive could use links to cause extraction operations to create or overwrite files outside the intended destination directory.

The issue affected Unpack, UnpackLayer, Untar, UntarUncompressed, and the ApplyLayer helpers. Users should upgrade and avoid extracting untrusted archives with earlier versions.

What's Changed

• archive: harden tar extraction against path traversal #​45
• archive: do not follow reparse points in chtimes #​90
• archive: fix creation time updates on Windows #​79
• archive: minor cleanups and godoc touch-up #​87
• archive: RebaseArchiveEntries: fix archive path rebasing #​43

Test and CI changes

• ci: enable dependabot for actions #​81
• archive: make breakoutErr unwrap its cause #​91
• archive: use filepath for filesystem paths in tests #​80
• archive: use filepath for filesystem paths in tests #​80

Full Changelog: moby/go-archive@v0.2.1...v0.3.0

v0.2.1

Compare Source

What's Changed

• reject out-of-range device numbers in layer #​36
• createImpliedDirectories: fix directory detection and path handling #​44
• createImpliedDirectories: honor NoLchown for implied directories #​70
• createTarFile: use switch for timestamp updates #​67
• drop redundant ExcludePatterns initialization #​62
• ExportChanges: use POSIX / Unix conventions for Tar operations #​41
• getInodeFromStat: return error on failure #​50
• overlayWhiteoutConverter.ConvertRead: avoid redundant chown #​55
• overlayWhiteoutConverter.ConvertWrite: explicitly use POSIX / Unix #​38
• overlayWhiteoutConverter.ConvertWrite: simplify directory check #​34
• overlayWhiteoutConverter: fixes and cleanups #​52
• RebaseArchiveEntries: use POSIX / Unix paths #​42
• tarAppender.addTarFile: normalize archivePath to POSIX #​40
• tarAppender.addTarFile: return error before writing header #​51
• TarOptions: document IncludeFiles, ExcludePatterns #​61
• Unpack: prevent nil-pointer if nil-options are passed #​66
• remove some intermediate vars #​53
• rename some vars to prevent shadowing "path" import #​35
• rename vars to prevent shadowing and for clarity #​39
• fix typos in comments #​59
• modernize code #​30

Test and CI changes

• ci: don't fail fast #​74
• ci: update golangci-lint to v2.12 for compatibility with go1.26 #​46
• ci: pin actions by sha #​22
• ci: use go.mod for "minimum" Go version, and use custom name #​29
• golangci-lint: enable gosec linter #​47
• fix some linting issues and use t.TempDir() in more places #​31
• add test to verify symlinks targets are preserved (skipped) #​48
• archive: add regression tests for tar path-traversal containment #​68
• archive: Add test for implied directories through symlinks #​76
• archive: fix breakout error type assertions in tests #​69
• archive: Test extracted file modes with process umask #​65
• chrootarchive: fix "non-root" skips on Windows #​71
• Reduce shelling out in tests #​64
• test: use current user for archive ownership in breakout tests #​72
• make toUnixPath more generic, and long-path aware #​58
• testBreakout: pre-create implied victim directory in breakout test #​73
• TestImpliedDirectoryPermissions: test with umask #​57

Dependency updates

• build: bump minimum Go version to 1.24 #​27
• build: bump minimum Go version to 1.25 #​28
• update github.com/moby/sys/sequential v0.7.0 #​75
• update github.com/klauspost/compress v1.18.7 #​78
• update moby/patternmatcher v0.6.1, klauspost/compress v1.18.3, sirupsen/logrus v1.9.4 #​23
• update moby/sys dependencies #​77

Full Changelog: moby/go-archive@v0.2.0...v0.2.1

v0.2.0

Compare Source

What's Changed

• remove aliases for deprecated types and functions #​10
• chrootarchive: remove redundant "init" mitigation for CVE-2019-14271 #​11
• xattr: Fix OS matching #​20
• TestOverlayTarUntar: remove redundant cmpopts.EquateEmpty #​9
• go.mod: bump github.com/klauspost/compress v1.18.2 #​19
• gha: update actions #​18

Full Changelog: moby/go-archive@v0.1.0...v0.2.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 6 additional dependencies were updated

Details:

Package	Change
github.com/klauspost/compress	v1.18.0 -> v1.18.7
github.com/moby/patternmatcher	v0.6.0 -> v0.6.1
github.com/moby/sys/sequential	v0.6.0 -> v0.7.0
github.com/moby/sys/user	v0.4.0 -> v0.4.1
github.com/sirupsen/logrus	v1.9.3 -> v1.9.4
github.com/go-logr/logr	v1.4.3 -> v1.4.3