SecuriTricks - CVE-2026-41568

Description

Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.

Product(s) Impacted

Vendor	Product	Versions
Docker	Docker Engine	<29.5.1
Moby	Moby Daemon	<2.0.0-beta.14

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-81

Improper Neutralization of Script in an Error Message Web Page

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters that could be interpreted as web-scripting elements when they are sent to an error page.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	docker	docker_engine	<29.5.1	/	/	/	/	/	/
a	moby	moby_daemon	<2.0.0-beta.14	/	/	/	/	/	/

References

https://github.com/moby/moby/security/advisories/GHSA-vp62-88p7-qqf5

CVSS Score

6.1 / 10

CVSS Data - 3.1

Attack Vector: LOCAL
Attack Complexity: HIGH
Privileges Required: LOW
Scope: CHANGED
Confidentiality Impact: NONE
Integrity Impact: LOW
Availability Impact: HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:H

View Vector String

Timeline

Published: June 12, 2026, 7:16 p.m.
Last Modified: June 12, 2026, 7:16 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

CVE-2026-41568