Container Path Leakage Vulnerability in github.com/docker/docker
Summary
GO-2022-1107: Container build can leak any path on the host into the container in github.com/docker/docker. Affects github.com/docker/docker versions < 20.10.20+incompatible. Fixed in 20.10.20+incompatible. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
github.com/docker/docker is an open-source containerization platform written in Go. It provides a set of tools and APIs for building, deploying, and managing containers. This vulnerability affects the container build process, allowing any path on the host system to be leaked into the container.
Vulnerability Detail
The container build process in github.com/docker/docker is susceptible to a path leakage vulnerability. This means that an attacker can exploit this vulnerability to access and leak any path on the host system into the container. The leaked paths may contain sensitive information or grant unauthorized access to resources within the host system. The vulnerability exists in versions prior to 20.10.20+incompatible.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
20.10.20+incompatible
This is the first release that contains the fix.
go get github.com/docker/docker@v20.10.20+incompatibleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is crucial to update to the fixed version as soon as possible to address the issue.
Conclusion
The container path leakage vulnerability in github.com/docker/docker allows an attacker to expose any path on the host system into the container. It is crucial to update to version 20.10.20+incompatible or later to mitigate this vulnerability and prevent unauthorized access to sensitive information or resources.
See every vulnerability recorded for github.com/docker/docker →
FAQ
github.com/docker/docker is an open-source containerization platform written in Go. It provides tools and APIs for building, deploying, and managing containers.
This vulnerability allows an attacker to leak any path on the host system into the container. This can lead to unauthorized access to sensitive information or resources within the host system.
Versions prior to 20.10.20+incompatible are affected by this vulnerability.
No, there is no specific workaround available for this vulnerability. Updating to the fixed version is the recommended solution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
