Directory Traversal Vulnerability in Docker
Summary
CVE-2014-9358: Directory Traversal in Docker in github.com/docker/docker. Affects github.com/docker/docker versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2014-9358 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker is an open-source platform that allows developers to automate the deployment and scaling of applications using containerization. It provides an efficient and lightweight way to package applications and their dependencies into isolated containers. The vulnerability affects the github.com/docker/docker package in the Go ecosystem.
Vulnerability Detail
The vulnerability is a directory traversal issue in Docker, which allows an attacker to access files outside of the intended directory. This can lead to unauthorized access, data leakage, and potential remote code execution. The vulnerability was identified in the github.com/docker/docker package and has been assigned the ID GO-2022-0705. It was first introduced in version 0 of the package and has been fixed in version 1.3.2.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.2
This is the first release that contains the fix.
go get github.com/docker/docker@v1.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The directory traversal vulnerability in Docker can be mitigated by updating the github.com/docker/docker package to version 1.3.2 or later. It is important for users to promptly apply the necessary updates to ensure the security of their Docker deployments.
See every vulnerability recorded for github.com/docker/docker →
FAQ
Docker is an open-source platform that enables developers to automate the deployment and scaling of applications using containerization.
Directory traversal is a technique used by attackers to access files and directories outside of the intended directory structure.
The vulnerability can lead to unauthorized access, data leakage, and potential remote code execution.
The vulnerability affects all versions of the package prior to version 1.3.2.
To update Docker, follow the official Docker documentation for upgrading the package to version 1.3.2 or later.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
