The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0872 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-17106:
    The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the     ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor     decides where each archive entry lands using lexical string checks and then performs the filesystem     operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of     the destination directory. An attacker who controls the contents of an archive can create or overwrite     files at arbitrary paths writable by the extracting process.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21611-1 advisory.

    Changes in apptainer:

    - Update github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106:
      The tar extraction routines in moby/go-archive do not confine       filesystem operations to the destination directory. A crafted       archive can create or overwrite files outside the intended       destination (bsc#1275248).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the
    ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor
    decides where each archive entry lands using lexical string checks and then performs the filesystem
    operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of
    the destination directory. An attacker who controls the contents of an archive can create or overwrite
    files at arbitrary paths writable by the extracting process. (CVE-2026-17106)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the     ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor     decides where each archive entry lands using lexical string checks and then performs the filesystem     operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of     the destination directory. An attacker who controls the contents of an archive can create or overwrite     files at arbitrary paths writable by the extracting process. (CVE-2026-17106)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
342065	TencentOS Server 4: moby (TSSA-2026:0872)	Nessus	Tencent Local Security Checks	Local	high
339033	openSUSE 16 Security Update : apptainer (openSUSE-SU-2026:21611-1)	Nessus	SuSE Local Security Checks	Local	high
446091	SCA: security update for github.com/moby/go-archive (GHSA-hfg8-hc9c-6c3h)	Tenable Cloud Security	SCA Checks	Local	high
446091	SCA: security update for github.com/moby/go-archive (GHSA-hfg8-hc9c-6c3h)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
338087	Linux Distros Unpatched Vulnerability : CVE-2026-17106	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-17106

high

Tenable Plugins

high

high

high

high

high