Description

An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-12T16:17:14.520Z",
  "pubdate": "2026-08-12T16:17:14.520Z",
  "executiveSummary": "This vulnerability involves an arbitrary file write condition affecting Docker cache management under specific remote-repository conditions. The flaw allows an authenticated user to bypass intended directory restrictions and write data outside the designated Docker cache path.\nThe primary impact of this security issue includes unauthorized filesystem manipulation, potential overwriting of critical system or application files, and potential escalation of privileges depending on the files and directories targeted during exploitation.\nThe vulnerability affects systems utilizing Docker cache mechanisms interacting with remote repositories. The risk implication is significant as it compromises the integrity of the host or container filesystem where the cache resides.\nTo exploit this vulnerability, an attacker requires authentication to the system and must leverage specific remote-repository conditions that fail to properly sanitize or validate cache destination paths. No further exploitation requirements are explicitly detailed beyond meeting these initial access and configuration prerequisites.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient path validation and sanitization within the Docker cache handling logic when processing data destined for remote repositories. Specifically, user-supplied path parameters or derived file identifiers lack adequate checks to ensure that destination paths remain strictly confined within the intended Docker cache directory.\nThe vulnerable component resides within the caching subsystem responsible for storing and retrieving remote-repository artifacts. When specific remote-repository conditions are met, the application constructs file paths insecurely, enabling directory traversal sequences (such as relative path components) to be processed by the file writing routines.\nExploitation requires the attacker to be authenticated. Armed with valid credentials, the attacker interacts with the vulnerable remote-repository feature, supplying specially crafted payloads or repository structures designed to trigger the path traversal condition.\nThe step-by-step attack flow proceeds as follows: First, the authenticated attacker establishes a session or sends a request associated with a targeted remote repository configured to interact with the vulnerable caching mechanism. Second, the attacker crafts a payload or repository artifact containing traversal sequences within its path metadata. Third, when the application processes and caches the incoming data, it fails to neutralize the traversal sequences. Consequently, the file writing operation resolves the path outside the intended boundaries, writing the attacker-controlled data to an arbitrary location on the filesystem accessible to the application process.\nThe post-exploitation impact is dictated by the privileges of the process executing the file write operation and the destination path selected by the attacker. If the process runs with elevated privileges or writes to sensitive application directories, the attacker may corrupt configuration files, overwrite binary executables, or plant malicious code intended for subsequent execution, thereby compromising the overall security posture of the host environment."
}