CVE-2014-9358: Directory Traversal in Docker
Summary
CVE-2014-9358: Directory Traversal in Docker. Affects github.com/docker/docker versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2014-9358 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker is an open-source platform that allows developers to automate the deployment and scaling of applications using containerization. It provides an efficient and lightweight alternative to traditional virtualization. Docker is implemented in Go and is widely used in the software development industry. However, prior to version 1.3.3, Docker had a vulnerability that allowed remote attackers to conduct path traversal attacks and spoof repositories. This vulnerability affected the 'github.com/docker/docker' package in the Go ecosystem.
Vulnerability Detail
The vulnerability in Docker stemmed from a lack of proper validation of image IDs. This allowed attackers to manipulate the image ID and perform directory traversal attacks. By crafting a malicious image and using it in a 'docker load' operation or during 'registry communications', an attacker could bypass security measures and gain unauthorized access to sensitive files or directories. The impact of this vulnerability could range from unauthorized data access to potential remote code execution.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.2
This is the first release that contains the fix.
go get github.com/docker/docker@v1.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update Docker to the latest version to address the issue effectively.
Conclusion
In conclusion, the vulnerability in Docker (CVE-2014-9358) allowed remote attackers to perform directory traversal attacks and spoof repositories. This could lead to unauthorized access to sensitive files or directories and potential data breaches. To mitigate this risk, it is crucial to update Docker to version 1.3.3 or later. Regularly updating software is essential to ensure the latest security patches are applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/docker/docker →
FAQ
Docker is an open-source platform that enables developers to automate the deployment and scaling of applications using containerization. It provides a lightweight and efficient alternative to traditional virtualization.
Directory traversal is a technique used by attackers to access files or directories outside of the intended scope. It involves manipulating file paths to navigate to parent directories or other locations that are not normally accessible.
This vulnerability allows remote attackers to conduct directory traversal attacks and potentially gain unauthorized access to sensitive files or directories. It could lead to data breaches, unauthorized data access, or even remote code execution.
Yes, the vulnerability can be fixed by updating Docker to version 1.3.3 or later. It is crucial to regularly update software to ensure the latest security patches are applied.
No, there are no known workarounds for this vulnerability. Updating Docker to the latest version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
