GO-2026-5668
Race condition in 'docker cp' in github.com/docker/docker allows creation of arbitrary files
Quick fix
GO-2026-5668 — github.com/moby/moby/v2: upgrade to the fixed version with the command below.
go get github.com/moby/moby/v2@v2.0.0-beta.14Details
A race condition in the Docker daemon allows an attacker to create arbitrary empty files on the host system during a "docker cp" operation by swapping a destination path with a symbolic link.
The affected code is in the daemon package, specifically the openContainerFS and createIfNotExists methods. This is daemon-owned, Linux-specific code and is not intended for external use as a Go library.
Are you affected?
Enter the version of the package you're using.
Affected packages
0 No fixed version published yet for github.com/docker/docker (go modules). Pin to a known-safe version or switch to an alternative.
0 No fixed version published yet for github.com/moby/moby (go modules). Pin to a known-safe version or switch to an alternative.
0 Fixed in: 2.0.0-beta.14 go get github.com/moby/moby/v2@v2.0.0-beta.14