CVE-2014-9356: Path Traversal in Docker in github.com/docker/docker
Summary
CVE-2014-9356: Path Traversal in Docker in github.com/docker/docker. Affects github.com/docker/docker versions < 1.3.3. Fixed in 1.3.3. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2014-9356 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/docker/docker, which is written in Go. Docker is an open-source platform that allows developers to automate the deployment and management of applications within containers. It provides an efficient and lightweight alternative to traditional virtualization. The vulnerability in question is a path traversal vulnerability that affects Docker.
Vulnerability Detail
The path traversal vulnerability in Docker allows an attacker to access files outside of the intended directory. By manipulating file paths, an attacker can potentially read or modify sensitive files on the host system. This can lead to unauthorized access, data leakage, or even remote code execution. The vulnerability was identified in the github.com/docker/docker package.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.3
This is the first release that contains the fix.
go get github.com/docker/docker@v1.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to implement proper input validation and sanitization to prevent path traversal attacks. Additionally, restricting access permissions and using containerization techniques can help mitigate the impact of such vulnerabilities.
Conclusion
The path traversal vulnerability in Docker can have serious security implications, allowing unauthorized access and potential data leakage. It is crucial to update to a secure version of Docker (1.3.3 or later) to mitigate the risk. Additionally, implementing best practices for input validation, access control, and containerization can further enhance the security of Docker deployments.
See every vulnerability recorded for github.com/docker/docker →
FAQ
Docker is an open-source platform that allows developers to automate the deployment and management of applications within containers. It provides an efficient and lightweight alternative to traditional virtualization.
A path traversal vulnerability, also known as directory traversal, allows an attacker to access files outside of the intended directory. By manipulating file paths, an attacker can potentially read or modify sensitive files on the host system.
The path traversal vulnerability in Docker can lead to unauthorized access, data leakage, or even remote code execution. An attacker could potentially read or modify sensitive files on the host system, compromising the security and integrity of the application and the underlying infrastructure.
To fix the vulnerability, it is recommended to update the Docker package to version 1.3.3 or later. This version includes a patch that addresses the path traversal vulnerability.
There is no specific workaround mentioned for this vulnerability. However, implementing proper input validation and sanitization, restricting access permissions, and using containerization techniques can help mitigate the impact of such vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
