Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/moby/go-archive | go | < 0.3.0 | 0.3.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a classic path traversal issue in the tar extraction functionality of moby/go-archive. An attacker could craft a tar archive with symbolic links that, when extracted, would point to locations outside of the intended destination directory. The core of the issue was that the code was performing lexical checks on file paths (filepath.Clean, filepath.Rel, strings.HasPrefix) to prevent traversal, but these checks were insufficient because they didn't account for how the operating system resolves symbolic links at runtime (a TOCTOU vulnerability). The patch addresses this by using os.OpenRoot (which is based on openat(2) semantics) to create a file system view that is strictly confined to the destination directory. All subsequent file system operations (creating files, directories, links, etc.) are then performed relative to this root, effectively sandboxing the extraction process and preventing any possibility of writing files outside the target directory. The main vulnerable functions identified are Unpack and UnpackLayer, which are the entry points for tar extraction, and the unexported helper functions createTarFile and createImpliedDirectories, where the unsafe file system operations were actually being performed.
Unpackarchive.go
UnpackLayerdiff.go
createTarFilearchive.go
createImpliedDirectoriesarchive.go