Skip to main content

Improper Neutralization of Script in an Error Message Web Page

CVE-2026-41568

Medium
6.1/10

Summary

Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions prior to 28.5.3, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.

  • HIGH
  • LOCAL
  • LOW
  • CHANGED
  • REQUIRED
  • LOW
  • NONE
  • HIGH

CWE-81 - Improper Neutralization of Script in an Error Message Web Page

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters that could be interpreted as web-scripting elements when they are sent to an error page.

References

Advisory Timeline

  • Published