CVE-2026-107174

Published: Ott 07, 2026 Last Modified: Ott 07, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,4
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: changed
Confidentiality: low
Integrity: low
Availability: none

Description

AI Translation Available

A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction directory. This allows the attacker to bypass sandbox boundaries, potentially leading to unauthorized information disclosure or file modification on the host system.

61

UNIX Symbolic Link (Symlink) Following

Incomplete
Abstraction: Compound Structure: Composite
Common Consequences
Security Scopes Affected:
Confidentiality Integrity
Potential Impacts:
Read Files Or Directories Modify Files Or Directories
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: High
View CWE Details
https://access.redhat.com/security/cve/CVE-2026-107174
https://access.redhat.com/security/cve/CVE-2026-107174
https://bugzilla.redhat.com/show_bug.cgi?id=2547419
https://bugzilla.redhat.com/show_bug.cgi?id=2547419