Vulnerability in Docker go-archive Library Allows File Creation and Overwrite Outside Target Directory
A vulnerability has been discovered in the go-archive archive processing library maintained under the Moby Project. The flaw affects several extraction functions and can be exploited to create or overwrite files outside the designated target directory.
The issue, assigned CVE-2026-17106, resides in the Unpack, UnpackLayer, and Untar routines. During archive extraction, the library validates the destination path as a string but does not account for differences in how the operating system resolves that path. As a result, an attacker-controlled archive can cause files to be written beyond the intended extraction root.
Docker assigned the vulnerability a CVSS v4.0 base score of 7.1 and rated it High severity. Public proof-of-concept code targeting macOS and Linux is already available, increasing the urgency for organizations that rely on affected Docker components.
The vulnerability has been addressed in go-archive 0.3.0. Corresponding fixes were released in Docker Engine 29.7.0, Docker CLI 29.7.0, and Docker Desktop 4.86.0. Administrators are advised to update these products promptly to mitigate the risk of unauthorized file operations.
Related articles
Microsoft Defender Zero-Day ShieldBreak Enables SYSTEM Privilege Escalation, Bypassing July Rogue Planet Patch
Security researcher Nightmare Eclipse has publicly disclosed a new zero-day vulnerability named ShieldBreak in Microsoft Defender that allows any standard Windows account to escalate privileges directly to SYSTEM level. The flaw exploits a TOCTOU race condition in Defender's file scanning API callbacks, enabling attackers to swap file contents during the brief window when the scanner reads the file. Although linked to the earlier Rogue Planet vulnerability (CVE-2026-50656), the July patch did not fully address the attack surface, and an adjusted proof-of-concept continues to work on patched systems. Defender's high privileges and trusted status in enterprise environments amplify the risk, as compromised processes can execute malicious actions that appear legitimate in logs. Public disclosure without prior private reporting leaves a window of exposure until Microsoft issues an official fix. Blue teams are advised to enforce strict local permissions, monitor for anomalous Defender process behavior such as unusual child processes or repeated file handle operations, and implement layered defenses including application whitelisting and network segmentation.
CISA Adds Two Remotely Exploitable TrueConf Server Vulnerabilities to KEV Catalog
The US Cybersecurity and Infrastructure Security Agency has added two critical vulnerabilities affecting TrueConf Server to its Known Exploited Vulnerabilities catalog. CVE-2026-72529 allows unauthenticated remote attackers to execute arbitrary scripts due to missing authentication in a critical function. CVE-2026-72530 is a code injection flaw that enables attackers to run arbitrary code on the underlying host system by escaping the sandboxed environment. Both issues can be exploited over TCP port 4307 without requiring authentication. Kaspersky assigned CVSS v3.1 base scores of 9.8 and 9.0 respectively, rating both as Critical. US federal agencies must apply mitigations for the first vulnerability by August 23 and for the second by September 3.
Zombie Card Attack Revives Expired Visa Cards for Contactless NFC Payments
Researchers from the University of Massachusetts Amherst have demonstrated the Zombie Card attack, which enables contactless payments with certain expired Visa cards over NFC without breaking cryptography or cloning the card. The technique exploits inconsistencies in how payment terminals and issuing banks validate card expiration dates within the EMV protocol. By deploying two Android smartphones as a relay between the expired card and the terminal, the researchers intercepted the EMV field containing the expiration date and substituted a future date during the transaction. The terminal accepted the locally validated payment while the cryptographic data remained valid because Visa EMV Kernel 3 does not always bind the expiration field to the protected cryptogram. Testing showed varying bank responses: one issuer approved transactions of different amounts at multiple merchants, while another consistently declined them. The attack failed against Mastercard, American Express, and Discover due to stricter cross-checks or cryptographic protection of the expiration data. The method requires an active account and valid keys on the expired card, making it more complex than traditional skimming.
Critical Unauthenticated File Upload Flaw in Elementor Pro Allows Remote Code Execution on WordPress Sites
A critical vulnerability tracked as CVE-2026-32475 has been discovered in the Elementor Pro plugin for WordPress, enabling unauthenticated attackers to upload and execute arbitrary PHP code. The flaw resides in the file upload module where validation and saving processes handle empty filenames inconsistently across multipart requests. Attackers can bypass checks by sending one part with an empty filename and another containing a PHP backdoor, which gets stored in the publicly accessible wp-content/uploads/elementor/forms/ directory. Exploitation requires a published Elementor Pro form with the multiple-file upload option enabled, a setting that is disabled by default. The free version of Elementor remains unaffected, while the issue was resolved in Elementor Pro 4.2.2. Administrators are urged to update immediately and scan upload directories for unauthorized PHP files, as no active exploitation has been observed yet but public disclosure increases the risk.