CyberRota Analysis
AI-GeneratedThe tar extraction routines in moby/go-archive are vulnerable due to improper confinement of filesystem operations, allowing attackers to manipulate archive contents to create or overwrite files at arbitrary writable paths outside the intended destination directory. This can lead to unauthorized access or modification of critical system files, posing a significant risk to system integrity. Organizations utilizing moby/go-archive for archive extraction should prioritize addressing this vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.