Bug 2547419 (CVE-2026-107174)

Summary: CVE-2026-107174 source-to-image: source-to-image: Security boundary bypass via absolute symbolic link extraction
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asatyam, asdas, dhanak, diagrawa, dpaolell, drosa, dsimansk, jdelft, jupierce, kingland, lgarciaa, mbiarnes, mnovotny, ppalepu, ppostler, prdhamdh, sabiswas, sausingh, security-response-team, sghai, sidsharm, suppawar, vlaad
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction directory. This allows the attacker to bypass sandbox boundaries, potentially leading to unauthorized information disclosure or file modification on the host system.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2547431    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-07 12:32:11 UTC 
A flaw was found in openshift/source-to-image's paranoid tar extraction mode (NewParanoid). The extractLink() function in pkg/tar/tar.go validates that a symlink target stays inside the extraction directory by computing a sanitized path using filepath.Clean(filepath.Join(dest, "..", source)), but then creates the actual symlink using the raw, unvalidated header.Linkname via os.Symlink(source, dest). For relative symlink traversals this check works correctly because filepath.Join resolves ".." components. However, for absolute Linkname values (e.g. "/etc/passwd"), Go's filepath.Join does not re-root, so the sanitized path folds harmlessly under the jail directory and passes the check, while the actual symlink points to the attacker-specified absolute host path. This bypasses the security boundary introduced to fix CVE-2018-1103. The paranoid mode is used by s2i's primary build strategy, including paths that extract tar streams produced by attacker-controlled builder image scripts (save-artifacts, assemble). A malicious builder image can plant symlinks pointing to arbitrary absolute host paths outside the sandbox directory.