CVE-2026-41568CWE-367CWE-81

Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap

Medium · published June 12, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
1.3
In the wild
Unconfirmed
What it is

Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00108 · 1.3th percentile
Weaknesses
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition; CWE-81 · Improper Neutralization of Script in an Error Message Web Page
Published
2026-06-12T18:08Z
EPSS history
Timeline
  • 12 JUN 18:08Z
    Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap
    cvelistv5