[alaudaa-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/moby/go-archive	v0.2.0 -> v0.3.0

---

moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive

BIT-docker-cli-2026-17106 / CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h / GO-2026-6253

More information

Details

moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive

Severity

Unknown

References

• https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h
• https://docs.docker.com/desktop/release-notes/#​4860
• https://github.com/bikini/exploitarium/tree/main/docker-cp-copyout-destination-escape
• https://github.com/docker/cli/releases/tag/v29.7.0
• https://github.com/moby/moby/issues/52948
• https://github.com/moby/moby/releases/tag/docker-v29.7.0
• https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

moby/go-archive: Crafted tar archive can write outside the extraction directory

BIT-docker-cli-2026-17106 / CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h

More information

Details

Summary

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination.

Details

The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so a links introduced by the archive can be followed out of the destination directory.

Impact

An attacker who controls the contents of archive can create or overwrite files at arbitrary paths writable by the extracting process.

Workarounds

Only extract trusted archives.

Severity

• CVSS Score: Unknown
• Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h
• https://github.com/moby/moby/issues/52948
• https://docs.docker.com/desktop/release-notes/#​4860
• https://github.com/bikini/exploitarium/tree/main/docker-cp-copyout-destination-escape
• https://github.com/docker/cli/releases/tag/v29.7.0
• https://github.com/moby/go-archive
• https://github.com/moby/moby/releases/tag/docker-v29.7.0
• https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

moby/go-archive (github.com/moby/go-archive)

v0.3.0

Compare Source

Security

This release fixes CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h, where a crafted tar archive could use links to cause extraction operations to create or overwrite files outside the intended destination directory.

The issue affected Unpack, UnpackLayer, Untar, UntarUncompressed, and the ApplyLayer helpers. Users should upgrade and avoid extracting untrusted archives with earlier versions.

What's Changed

• archive: harden tar extraction against path traversal https://github.com/moby/go-archive/pull/45
• archive: do not follow reparse points in chtimes https://github.com/moby/go-archive/pull/90
• archive: fix creation time updates on Windows https://github.com/moby/go-archive/pull/79
• archive: minor cleanups and godoc touch-up https://github.com/moby/go-archive/pull/87
• archive: RebaseArchiveEntries: fix archive path rebasing https://github.com/moby/go-archive/pull/43

Test and CI changes

• ci: enable dependabot for actions https://github.com/moby/go-archive/pull/81
• archive: make breakoutErr unwrap its cause https://github.com/moby/go-archive/pull/91
• archive: use filepath for filesystem paths in tests https://github.com/moby/go-archive/pull/80
• archive: use filepath for filesystem paths in tests https://github.com/moby/go-archive/pull/80

Full Changelog: moby/go-archive@v0.2.1...v0.3.0

v0.2.1

Compare Source

What's Changed

• reject out-of-range device numbers in layer https://github.com/moby/go-archive/pull/36
• createImpliedDirectories: fix directory detection and path handling https://github.com/moby/go-archive/pull/44
• createImpliedDirectories: honor NoLchown for implied directories https://github.com/moby/go-archive/pull/70
• createTarFile: use switch for timestamp updates https://github.com/moby/go-archive/pull/67
• drop redundant ExcludePatterns initialization https://github.com/moby/go-archive/pull/62
• ExportChanges: use POSIX / Unix conventions for Tar operations https://github.com/moby/go-archive/pull/41
• getInodeFromStat: return error on failure https://github.com/moby/go-archive/pull/50
• overlayWhiteoutConverter.ConvertRead: avoid redundant chown https://github.com/moby/go-archive/pull/55
• overlayWhiteoutConverter.ConvertWrite: explicitly use POSIX / Unix https://github.com/moby/go-archive/pull/38
• overlayWhiteoutConverter.ConvertWrite: simplify directory check https://github.com/moby/go-archive/pull/34
• overlayWhiteoutConverter: fixes and cleanups https://github.com/moby/go-archive/pull/52
• RebaseArchiveEntries: use POSIX / Unix paths https://github.com/moby/go-archive/pull/42
• tarAppender.addTarFile: normalize archivePath to POSIX https://github.com/moby/go-archive/pull/40
• tarAppender.addTarFile: return error before writing header https://github.com/moby/go-archive/pull/51
• TarOptions: document IncludeFiles, ExcludePatterns https://github.com/moby/go-archive/pull/61
• Unpack: prevent nil-pointer if nil-options are passed https://github.com/moby/go-archive/pull/66
• remove some intermediate vars https://github.com/moby/go-archive/pull/53
• rename some vars to prevent shadowing "path" import https://github.com/moby/go-archive/pull/35
• rename vars to prevent shadowing and for clarity https://github.com/moby/go-archive/pull/39
• fix typos in comments https://github.com/moby/go-archive/pull/59
• modernize code https://github.com/moby/go-archive/pull/30

Test and CI changes

• ci: don't fail fast https://github.com/moby/go-archive/pull/74
• ci: update golangci-lint to v2.12 for compatibility with go1.26 https://github.com/moby/go-archive/pull/46
• ci: pin actions by sha https://github.com/moby/go-archive/pull/22
• ci: use go.mod for "minimum" Go version, and use custom name https://github.com/moby/go-archive/pull/29
• golangci-lint: enable gosec linter https://github.com/moby/go-archive/pull/47
• fix some linting issues and use t.TempDir() in more places https://github.com/moby/go-archive/pull/31
• add test to verify symlinks targets are preserved (skipped) https://github.com/moby/go-archive/pull/48
• archive: add regression tests for tar path-traversal containment https://github.com/moby/go-archive/pull/68
• archive: Add test for implied directories through symlinks https://github.com/moby/go-archive/pull/76
• archive: fix breakout error type assertions in tests https://github.com/moby/go-archive/pull/69
• archive: Test extracted file modes with process umask https://github.com/moby/go-archive/pull/65
• chrootarchive: fix "non-root" skips on Windows https://github.com/moby/go-archive/pull/71
• Reduce shelling out in tests https://github.com/moby/go-archive/pull/64
• test: use current user for archive ownership in breakout tests https://github.com/moby/go-archive/pull/72
• make toUnixPath more generic, and long-path aware https://github.com/moby/go-archive/pull/58
• testBreakout: pre-create implied victim directory in breakout test https://github.com/moby/go-archive/pull/73
• TestImpliedDirectoryPermissions: test with umask https://github.com/moby/go-archive/pull/57

Dependency updates

• build: bump minimum Go version to 1.24 https://github.com/moby/go-archive/pull/27
• build: bump minimum Go version to 1.25 https://github.com/moby/go-archive/pull/28
• update github.com/moby/sys/sequential v0.7.0 https://github.com/moby/go-archive/pull/75
• update github.com/klauspost/compress v1.18.7 https://github.com/moby/go-archive/pull/78
• update moby/patternmatcher v0.6.1, klauspost/compress v1.18.3, sirupsen/logrus v1.9.4 https://github.com/moby/go-archive/pull/23
• update moby/sys dependencies https://github.com/moby/go-archive/pull/77

Full Changelog: moby/go-archive@v0.2.0...v0.2.1

---

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[alaudaa-renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -d -t ./...
go: -d flag is deprecated. -d=true is a no-op
go: downloading github.com/moby/go-archive v0.3.0
go: github.com/aquasecurity/trivy/internal/testutil imports
	github.com/testcontainers/testcontainers-go imports
	github.com/moby/go-archive: github.com/moby/go-archive@v0.3.0: Get "https://build-nexus.alauda.cn/repository/golang/github.com/moby/go-archive/@v/v0.3.0.zip": dial tcp: lookup build-nexus.alauda.cn: i/o timeout