CVE-2026-28406

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-28406
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28406.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-28406
Aliases
Published
2026-02-27T21:20:52.764Z
Modified
2026-03-03T02:58:11.164940Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L CVSS Calculator
Summary
kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory
Details

kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using filepath.Join(dest, cleanedName) without enforcing that the final path stays within dest. A tar entry like ../outside.txt escapes the extraction root and writes files outside the destination directory. In environments with registry authentication, this can be chained with docker credential helpers to achieve code execution within the executor process. Version 1.25.10 uses securejoin for path resolution in tar extraction.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28406.json"
}
References

Affected packages

Git / github.com/chainguard-forks/kaniko

Affected ranges

Type
GIT
Repo
https://github.com/chainguard-forks/kaniko
Events
Introduced
b150b665be245dd69f57e49011bbf2d28900976c
Fixed
a370e4b1f66e6e842b685c8f70ed507964c4b221

Affected versions

v1.*
v1.25.4
v1.25.5
v1.25.6
v1.25.7
v1.25.8
v1.25.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28406.json"