GO-2026-5746

See a problem?
Please try reporting it to the source first.
Source
https://pkg.go.dev/vuln/GO-2026-5746
Import Source
https://vuln.go.dev/ID/GO-2026-5746.json
JSON Data
https://api.test.osv.dev/v1/vulns/GO-2026-5746
Aliases
Downstream
Published
2026-06-25T22:34:38Z
Modified
2026-07-23T17:45:24Z
Summary
Docker: 'PUT /containers/{id}/archive' executes container binary on the host in github.com/docker/docker
Details

The Docker daemon's implementation of the "PUT /containers/{id}/archive" endpoint executes a container binary on the host when extracting an archive to a container. On Unix-like systems, this can be exploited if an attacker can control the container's filesystem or the archive being extracted, potentially leading to privilege escalation or host compromise.

The affected code is located in the daemon package, specifically in the containerExtractToDir method of the Daemon struct. This package is part of the Moby daemon's core and is not intended for external use as a library.

Database specific 
{
    "review_status":  "REVIEWED",
    "url":  "https://pkg.go.dev/vuln/GO-2026-5746"
}
References

Affected packages

Go / github.com/docker/docker

Package

Name
github.com/docker/docker
View open source insights on deps.dev
Purl
pkg:golang/github.com/docker/docker

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Ecosystem specific 

{
    "imports":  [
        {
            "path":  "github.com/docker/docker/daemon",
            "symbols":  [
                "Daemon.containerExtractToDir"
            ]
        }
    ]
}

Database specific

source 
"https://vuln.go.dev/ID/GO-2026-5746.json"

Go / github.com/moby/moby

Package

Name
github.com/moby/moby
View open source insights on deps.dev
Purl
pkg:golang/github.com/moby/moby

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Ecosystem specific 

{
    "imports":  [
        {
            "path":  "github.com/moby/moby/daemon",
            "symbols":  [
                "Daemon.containerExtractToDir"
            ]
        }
    ]
}

Database specific

source 
"https://vuln.go.dev/ID/GO-2026-5746.json"

Go / github.com/moby/moby/v2

Package

Name
github.com/moby/moby/v2
View open source insights on deps.dev
Purl
pkg:golang/github.com/moby/moby/v2

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.0.0-beta.14

Ecosystem specific 

{
    "imports":  [
        {
            "path":  "github.com/moby/moby/v2/daemon",
            "symbols":  [
                "Daemon.containerExtractToDir"
            ]
        }
    ]
}

Database specific

source 
"https://vuln.go.dev/ID/GO-2026-5746.json"