CVE-2026-28406

{"id": "CVE-2026-28406", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "published": "2026-02-27T22:16:23.513", "references": [{"url": "https://github.com/chainguard-forks/kaniko/commit/a370e4b1f66e6e842b685c8f70ed507964c4b221", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/chainguard-forks/kaniko/pull/326", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/chainguard-forks/kaniko/security/advisories/GHSA-6rxq-q92g-4rmf", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using `filepath.Join(dest, cleanedName)` without enforcing that the final path stays within `dest`. A tar entry like `../outside.txt` escapes the extraction root and writes files outside the destination directory. In environments with registry authentication, this can be chained with docker credential helpers to achieve code execution within the executor process. Version 1.25.10 uses securejoin for path resolution in tar extraction."}, {"lang": "es", "value": "kaniko es una herramienta para construir im\u00e1genes de contenedores a partir de un Dockerfile, dentro de un contenedor o un cl\u00faster de Kubernetes. A partir de la versi\u00f3n 1.25.4 y antes de la versi\u00f3n 1.25.10, kaniko descomprime archivos de contexto de construcci\u00f3n usando 'filepath.Join(dest, cleanedName)' sin asegurar que la ruta final permanezca dentro de 'dest'. Una entrada tar como '../outside.txt' escapa la ra\u00edz de extracci\u00f3n y escribe archivos fuera del directorio de destino. En entornos con autenticaci\u00f3n de registro, esto puede encadenarse con los ayudantes de credenciales de docker para lograr la ejecuci\u00f3n de c\u00f3digo dentro del proceso del ejecutor. La versi\u00f3n 1.25.10 utiliza securejoin para la resoluci\u00f3n de rutas en la extracci\u00f3n de tar."}], "lastModified": "2026-03-06T19:29:21.457", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:chainguard:kaniko:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D7F83A1-ABE0-40A9-87E9-15913B15DE13", "versionEndExcluding": "1.25.10", "versionStartIncluding": "1.25.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}