Product:
cctl image load and container image load
Summary
The ArchiveReader.extractContents() function performs no pathname validation before extracting an archive member. This allows a maliciously constructed archive to extract files into any user-writable location on the system using relative pathnames. This issue is addressed in container 0.8.0 and containerization 0.21.0.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2026-20613 |
Exploitation
An attacker can exploit this vulnerability by creating a specially crafted archive file that contains relative pathnames. When the ArchiveReader.extractContents() function processes this archive, it can extract files to unintended locations on the system, potentially overwriting existing files or placing malicious files in accessible directories.
Affected Products
- cctl image load: Affected by the lack of pathname validation, allowing arbitrary file extraction.
- container image load: Also vulnerable to the same issue, enabling potential exploitation through crafted archives.
Mitigation
To mitigate this vulnerability, users should update to the latest versions of the affected products, specifically container 0.8.0 and containerization 0.21.0, which include the necessary pathname validation to prevent unauthorized file extraction.