CVE-2026-17106: symlink-following path traversal in tar extraction (moby/go-archive); same bug class tested against doos's own extractor
Scope: audit · README · COMPARISON · docs/RESEARCH
CVSS 7.1 (High). Fixes: moby/go-archive >= 0.3.0, Docker Engine/CLI >= 29.7.0.
Source
Relevance to doos
This specific CVE is in moby/go-archive's extractor for docker cp (container-to-host
copy-out), which doos does not have. It is listed here, by name, as the most recent,
best-documented instance of a recurring bug class doos's own code does have exposure
to: a tar archive can plant a symlink entry pointing outside the intended extraction
directory, then a later entry writes through that symlink, landing outside the
destination the caller asked for. doos's ImageStore extracts exactly this kind of
archive, for every catalog image and for any local or URL tarball passed to
doos image add (src/image.cpp). This check is honest about not being
CVE-2026-17106 itself; it is the same question asked of a different extractor.
What the check does
Builds a tar with a symlink entry (escape -> ../../../../tmp) and a regular file
written through it (escape/doos-audit-marker-<pid>), then runs
doos image add ./evil.tar.gz --sha256 <real-hash> evilaudit. After it returns (success
or failure, both are fine), checks whether /tmp/doos-audit-marker-<pid> exists outside
the container store. Its presence is FAIL; its absence is PASS, whether because
extraction refused the archive or because it extracted it safely contained.
Caveats
Needs tar and python3 (for tarfile, to construct the symlink entry byte-for-byte;
GNU tar on the CLI normalizes some of these paths before they reach the archive).
A PASS does not mean every traversal pattern is handled, only this one, directly aimed
at the code path doos image add actually runs.
Run: make test in this directory, or make -C audit test from the repo root.