Linux Distros Unpatched Vulnerability : CVE-2026-17106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to...

PT-2026-78442

Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated save-waterfall-snapshot Socket.IO command passes attacker-controlled snapshotName input from backend/handlers/entities/sdr.py to...

CVE-2026-52875

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync,...

CVE-2026-52872

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its...

CVE-2026-52875 Streambert: Arbitrary Directory Creation and File Manipulation via Backup Handler

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync,...

EUVD-2026-62199

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync,...

CVE-2026-52875 Streambert: Arbitrary Directory Creation and File Manipulation via Backup Handler

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync,...

CVE-2026-52875

Streambert is a cross-platform Electron desktop app for streaming and downloading video. Prior to 2.6.0 , the perform-scheduled-backup IPC handler in src/ipc/storage.js accepts settings.path from a renderer-supplied object and performs filesystem operations (fs.mkdirSync, fs.writeFileSync, fs.rea...

CVE-2026-47699 Confidential Containers Guest Components image-rs: zip-slip-class arbitrary file write via absolute entry path in hardlink fallback

Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image layer can make imagers::stream::unpack::unpack create a hardlink outside its destination directory. In image-rs/src/stream/unpack.rs,...

CVE-2026-47699 Confidential Containers Guest Components image-rs: zip-slip-class arbitrary file write via absolute entry path in hardlink fallback

Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image layer can make imagers::stream::unpack::unpack create a hardlink outside its destination directory. In image-rs/src/stream/unpack.rs,...

CVE-2026-47699

Confidential Containers Guest Components (versions 0.16.0 through 0.19.x) contains a path traversal vulnerability in the image-rs crate's try_hardlink_fallback() function. When unpacking a crafted OCI image layer, the function computes the hardlink destination using destination.join(&entry_rel). ...

moby/go-archive: Crafted tar archive can write outside the extraction directory

Summary The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination. Details The extracto...

GHSA-HFG8-HC9C-6C3H moby/go-archive: Crafted tar archive can write outside the extraction directory

Summary The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination. Details The extracto...

CVE-2026-68924

creationtimestamp| type| source ---|---|--- 2026-08-18 20:35:08+00:00| published-proof-of-concept| https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-x768-8642-mmq9...

CVE-2026-17106

The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the...

DEBIAN-CVE-2026-17106

The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the...

CVE-2026-17106

The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the...

EUVD-2026-61112

The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the...

CVE-2026-17106

CVE-2026-17106 is a TOCTOU race in docker cp caused by two flaws in moby/go-archive: the daemon's tar walk and the CLI's extraction both use different path values for validation vs. filesystem operations. An attacker-controlled container plants a symlink in the archive; the CLI validates a constr...

CVE-2026-17106 Tar extraction in moby/go-archive can write outside the destination directory via link following

The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the...