High [CVE-2026-17106] Arbitrary file write via link following in tar extraction

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory.

The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory.

An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process. This could lead to unauthorized modification of system files or potentially arbitrary code execution.

This Important severity vulnerability in `moby/go-archive` allows for arbitrary file writes during tar extraction.

An attacker providing a specially crafted tar archive can exploit symlink following to create or overwrite files outside the intended directory, potentially leading to system compromise in environments processing untrusted archives, such as container build systems. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Weakness: CWE-59.

Affected products named by the advisory: Red Hat Enterprise Linux 10; Logging Subsystem for Red Hat OpenShift 6.6; Multicluster Global Hub 1.8.2; Red Hat Advanced Cluster Management for Kubernetes 2.17; and 18 more.