CVE-2025-48387

ADVISORY - github

Summary

v3.0.8, v2.1.2, v1.16.4 and below

Has been patched in 3.0.9, 2.1.3, and 1.16.5

You can use the ignore option to ignore non files/directories.

  ignore (_, header) {
    // pass files & directories, ignore e.g. symlinks
    return header.type !== 'file' && header.type !== 'directory'
  }

Thank you Caleb Brown from Google Open Source Security Team for reporting this in detail.

EPSS Score⁠: 0.00134 (0.340)

ADVISORY - nist

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

ADVISORY - github

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

ADVISORY - gitlab

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities

ADVISORY - redhat

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.