Bug 2526990

Summary: CVE-2026-17106 prometheus-podman-exporter: moby/go-archive: Arbitrary file write via link following in tar extraction [epel-all]
Product: [Fedora] Fedora EPEL Reporter: Isaiah Johnson <isjohnso>
Component: prometheus-podman-exporterAssignee: Navid Yaghoobi <n.yaghoobi.s>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: epel10CC: go-sig, n.yaghoobi.s
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["d716788f-3889-4850-a655-2939f67371f2"]}
Fixed In Version: prometheus-podman-exporter-2.0.0-1.el10_4 Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-09-22 00:35:34 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2518147    

Description Isaiah Johnson 2026-09-01 19:53:00 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.
Comment 1 Fedora Update System 2026-09-13 09:44:37 UTC 
FEDORA-EPEL-2026-05d6db7a0f (prometheus-podman-exporter-2.0.0-1.el10_4) has been submitted as an update to Fedora EPEL 10.4.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-05d6db7a0f
Comment 2 Fedora Update System 2026-09-14 01:38:35 UTC 
FEDORA-EPEL-2026-05d6db7a0f has been pushed to the Fedora EPEL 10.4 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-05d6db7a0f

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Comment 3 Fedora Update System 2026-09-22 00:35:34 UTC 
FEDORA-EPEL-2026-05d6db7a0f (prometheus-podman-exporter-2.0.0-1.el10_4) has been pushed to the Fedora EPEL 10.4 stable repository.
If problem still persists, please make note of it in this bug report.