Plan
active
Moby v25.0.18 patches tar path-traversal CVE-2026-17106
- Platform/SRE — Plan: CVE-2026-17106 allows a crafted tar archive to write outside the extraction directory in the Docker engine — real exposure for any host running Moby/Docker, but not KEV-listed and EPSS is 0.00 with no active exploitation evidence. Schedule an upgrade to v25.0.18 this sprint rather than treating it as an emergency.
- CI/CD — Skip
- Leader — Skip
- Signals: major release (25.0) · CVE-2026-17106 — CISA KEV: not listed, EPSS 0.00
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.