RHSA-2026:77656 | Vulnetix

RHSA-2026:77656 PUBLISHED CVSS 7.5 HIGH

A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by including symbolic links, allowing them to create or overwrite files at arbitrary locations on the system where the archive is being extracted. This could lead to unauthorized modification of system files or potentially arbitrary code execution.

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected Products

Vendor	Product	Versions
Red Hat	registry.redhat.io/quay/quay-rhel8@sha256:fb430174cec4428f0824787842e18f04d5eea0f5355cc90d1919ee1007086202_s390x as a component of Red Hat Quay 3.9	*
Red Hat	registry.redhat.io/quay/clair-rhel8@sha256:929267241996772aa38f66050d8a3da2fb2486ecbc9947713b0985360ed5c08b_ppc64le as a component of Red Hat Quay 3.9	*
Red Hat	registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e46445ea2b541e99e53cbf1af373f993f23ac94550c4778903b427015d9a19d7_ppc64le as a component of Red Hat Quay 3.9	*
Red Hat	registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5ed9fd3f7e0cb37d5af57d47034f09f86faff23ce312e5ef855810b93ea95611_amd64 as a component of Red Hat Quay 3.9	*
Red Hat	registry.redhat.io/quay/quay-operator-rhel8@sha256:5d2c73aff1bbcc5180996c6697f878072716d7425133edb3846384a22ca9155c_s390x as a component of Red Hat Quay 3.9	*
Red Hat	registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:069e37db34381a35d170461a66b904ca7fb8ffa3f0e71b4ded079d5bedb458d5_amd64 as a component of Red Hat Quay 3.9	*
Red Hat	registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:3d287bd34a69166eeb859c7245a91c6e95b2f729a51cc74060d7ae18052053f4_s390x as a component of Red Hat Quay 3.9	*
Red Hat	registry.redhat.io/quay/quay-builder-rhel8@sha256:8b3e0a8e7ae705f531ccf98b0d2cdb38b205e3ef11b5e3b9c420f6868a58ad90_s390x as a component of Red Hat Quay 3.9	*
Red Hat	registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b587c26256a429d4660375a8ea87674656cb3619b2dae592f0ea94ea6ee43a30_amd64 as a component of Red Hat Quay 3.9	*
Red Hat	registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:03ea617a30b7daab5cc0d7eb994f8b3c83be7af5cecbbca7bd5493be712fb13f_ppc64le as a component of Red Hat Quay 3.9	*
Red Hat	registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:01c8b93ac89087440a9c53e0f727476e529abf515d0a7d531ff1216fee9753fd_s390x as a component of Red Hat Quay 3.9	*
Red Hat	registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a95fe1043f64c9da4c6b7be35848a91a013a89d718f6dd38d2ea6fb257790195_amd64 as a component of Red Hat Quay 3.9	*
Red Hat	registry.redhat.io/quay/quay-operator-bundle@sha256:d8ce8cee8338f7e7dc0c86405606cf610402768e504d7dfb1ea4a0e6795320ac_amd64 as a component of Red Hat Quay 3.9	*
Red Hat	registry.redhat.io/quay/quay-builder-rhel8@sha256:04d793532101024985034fcfa26aeca2bbe9cdc4b8d4c0dcfdb5deffe6eca839_ppc64le as a component of Red Hat Quay 3.9	*
Red Hat	registry.redhat.io/quay/clair-rhel8@sha256:fedfa95c3de2182f416a7ece5371844698891b521e5667be0b77b766a2216bb3_s390x as a component of Red Hat Quay 3.9	*
Red Hat	registry.redhat.io/quay/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee_amd64 as a component of Red Hat Quay 3.9	*
Red Hat	registry.redhat.io/quay/quay-builder-rhel8@sha256:373b765b533fc4740ed401fc40b69d487213168633d711556a0bea59b02a527e_amd64 as a component of Red Hat Quay 3.9	*
Red Hat	registry.redhat.io/quay/quay-operator-rhel8@sha256:1cc683582ba1700545d5648f17735d680fd7a8c17fca6021fb52b9d2192e1fa2_amd64 as a component of Red Hat Quay 3.9	*
Red Hat	registry.redhat.io/quay/quay-rhel8@sha256:bf7ee07a25cd269986e054e0b04daebcb250b04fc3de60055a17142a932f5530_ppc64le as a component of Red Hat Quay 3.9	*
Red Hat	registry.redhat.io/quay/clair-rhel8@sha256:bc89c3dd056f1158c159d9abcf38ede260cf975941877b73e97cde6735534b83_amd64 as a component of Red Hat Quay 3.9	*

…and 2 more

Timeline

Oct 7, 2026 CVE Published
Oct 8, 2026 CVE Updated
Oct 8, 2026 Distribution Patch
Oct 8, 2026 Distribution Patch
Oct 8, 2026 Security Advisory
Oct 8, 2026 Security Advisory
Oct 8, 2026 Security Advisory
Oct 8, 2026 Security Advisory
Oct 8, 2026 Security Advisory
Oct 8, 2026 Security Advisory
Oct 8, 2026 Security Advisory
Oct 8, 2026 Security Advisory

References

https://access.redhat.com/errata/RHSA-2026:77656 advisory
https://access.redhat.com/security/cve/CVE-2026-17106 advisory
https://access.redhat.com/security/cve/CVE-2026-49825 advisory
https://access.redhat.com/security/cve/CVE-2026-54770 advisory
https://access.redhat.com/security/cve/CVE-2026-59879 advisory
https://access.redhat.com/security/cve/CVE-2026-77403 advisory
https://access.redhat.com/security/cve/CVE-2026-77404 advisory
https://access.redhat.com/security/cve/CVE-2026-77406 advisory
https://access.redhat.com/security/cve/CVE-2026-77409 advisory
https://access.redhat.com/security/cve/CVE-2026-77410 advisory
https://access.redhat.com/security/cve/CVE-2026-77412 advisory
https://access.redhat.com/security/cve/CVE-2026-79921 advisory
https://access.redhat.com/security/cve/CVE-2026-82417 advisory
https://access.redhat.com/security/cve/CVE-2026-84292 advisory
https://access.redhat.com/security/cve/CVE-2026-84394 advisory
https://access.redhat.com/security/cve/CVE-2026-87776 advisory
https://access.redhat.com/security/updates/classification/ advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_77656.json advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2518147 issue
https://www.cve.org/CVERecord?id=CVE-2026-17106 advisory

…and 90 more

Open in Interactive Console →