CVE-2021-3762: Path Traversal Vulnerability in claircore
Summary
CVE-2021-3762: Path traversal in claircore. Affects github.com/quay/claircore across 3 version ranges.
< 0.4.8
>= 0.5.0, < 0.5.5
>= 1.0.0, < 1.1.0
Fixed in 0.4.8, 0.5.5 or 1.1.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The claircore package is a component of the Clair vulnerability scanner. It is written in Go and is responsible for scanning container images for vulnerabilities. Claircore provides functionality for analyzing container images and identifying potential security issues. However, a directory traversal vulnerability has been discovered in the ClairCore engine, which can be exploited by an attacker to perform arbitrary file write operations on the filesystem. This could potentially lead to remote code execution.
Vulnerability Detail
The directory traversal vulnerability in claircore allows an attacker to bypass file system restrictions and write arbitrary files to the system. By supplying a specially crafted container image, an attacker can trigger the vulnerability during the scanning process. This can lead to unauthorized modification of files and potentially enable remote code execution. The vulnerability has a CVSSv3 score of 7.8, indicating a high severity level.
How To Fix
Latest published version: v1.6.1 as of 23 Oct 2026
go get github.com/quay/claircore@v1.6.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.4.80.4.8go get github.com/quay/claircore@v0.4.8 -
>= 0.5.0, < 0.5.50.5.5go get github.com/quay/claircore@v0.5.5 -
>= 1.0.0, < 1.1.01.1.0go get github.com/quay/claircore@v1.1.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the claircore package to the fixed versions as soon as possible.
Conclusion
The directory traversal vulnerability in claircore poses a significant risk to systems using the affected versions. It allows an attacker to write arbitrary files to the filesystem, potentially leading to remote code execution. To mitigate this vulnerability, it is crucial to update the claircore package to the fixed versions (0.4.8, 1.1.0, or 0.5.5). For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/quay/claircore →
FAQ
The vulnerability allows an attacker to write arbitrary files to the filesystem, potentially leading to remote code execution.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is crucial to update the claircore package to the fixed versions to prevent any potential exploitation.
No, updating the claircore package to the fixed versions is the only way to mitigate this vulnerability. It is recommended to update the package as soon as possible.
You can find more information about this vulnerability, including the technical details and the fixed versions, in the advisory on the GitHub Advisory Database: [link to advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/quay/claircore.
