CVE-2015-3631: Arbitrary File Override in Docker Engine
Summary
CVE-2015-3631: Arbitrary File Override in Docker Engine in github.com/docker/docker. Affects github.com/docker/docker versions < 1.6.1. Fixed in 1.6.1. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2015-3631 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker Engine is an open-source containerization platform that allows developers to automate the deployment and management of applications within containers. It provides a lightweight and portable environment for running applications, isolating them from the underlying infrastructure. The vulnerability identified as CVE-2015-3631 affects the Docker Engine codebase hosted on GitHub under the repository 'github.com/docker/docker'.
Vulnerability Detail
The vulnerability CVE-2015-3631 is an Arbitrary File Override issue in Docker Engine. It allows an attacker to override arbitrary files on the host system by manipulating certain Docker Engine functionalities. This can lead to unauthorized access, data loss, or even remote code execution on the host machine. The vulnerability was introduced in version 0 of the 'github.com/docker/docker' package and was fixed in version 1.6.1.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.1
This is the first release that contains the fix.
go get github.com/docker/docker@v1.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, it is highly recommended to follow the steps mentioned in the 'how_to_fix' section to mitigate the risk associated with this vulnerability.
Conclusion
The vulnerability CVE-2015-3631 in Docker Engine allows for arbitrary file override, potentially leading to unauthorized access, data loss, or remote code execution. It is crucial to update the 'github.com/docker/docker' package to version 1.6.1 or later and keep Docker Engine up to date to mitigate the risk associated with this vulnerability.
See every vulnerability recorded for github.com/docker/docker →
FAQ
Docker Engine is an open-source containerization platform that automates the deployment and management of applications within containers.
An Arbitrary File Override vulnerability allows an attacker to manipulate certain functionalities to override arbitrary files on the host system, potentially leading to unauthorized access or remote code execution.
This vulnerability can result in unauthorized access to sensitive files, data loss, or even remote code execution on the host machine.
The vulnerability was introduced in version 0 of the 'github.com/docker/docker' package and was fixed in version 1.6.1.
To fix this vulnerability, update the 'github.com/docker/docker' package to version 1.6.1 or later and regularly update Docker Engine to apply the latest security patches.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
