Moby, an open-source container framework, and Docker Engine contain a vulnerability (CVE-2026-41567) due to an uncontrolled search path element (CWE-427). When a compressed archive is uploaded to a container or piped through docker cp, the daemon incorrectly uses decompression binaries (e.g., xz, unpigz) from the container's filesystem rather than the host's. This flaw allows a malicious container image containing trojanized decompression binaries to execute arbitrary code with full daemon privileges, including host root UID and unrestricted capabilities. The vulnerability affects Moby versions prior to 29.5.1 and moby/moby v2 versions prior to v2.0.0-beta.14. The issue is addressed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Red Hat advisory confirms the severity and recommends mitigation steps such as running trusted images and restricting access to the PUT /containers/{id}/archive endpoint.

Successful exploitation allows arbitrary code execution with full daemon privileges, including host root access and unrestricted capabilities. This can lead to complete compromise of the host system if a malicious container image is used to upload a compressed archive. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

A fix is available in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Users should upgrade to these versions or later. Until patched, mitigation includes running containers only from trusted images, avoiding piping compressed archives into containers created from untrusted images, and using authorization plugins to restrict access to the PUT /containers/{id}/archive endpoint. Red Hat advisory emphasizes these mitigations and does not indicate any 'no action required' status.