CVE-2014-9356: Path Traversal in Docker
Summary
CVE-2014-9356: Path Traversal in Docker. Affects github.com/docker/docker versions < 1.3.3. Fixed in 1.3.3. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2014-9356 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker is an open-source platform that allows developers to automate the deployment and management of applications within containers. It provides an efficient and lightweight alternative to traditional virtualization. Docker is written in Go and is widely used in the software development industry. However, prior to version 1.3.3, Docker was vulnerable to a path traversal attack.
Vulnerability Detail
The path traversal vulnerability in Docker allows remote attackers to write to arbitrary files and bypass container protection mechanisms. This vulnerability can be exploited by providing a full pathname in a symlink within an image or a build in a Dockerfile. By manipulating the symlink, an attacker can gain unauthorized write access to files outside the container's filesystem, potentially leading to unauthorized data modification or code execution.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.3
This is the first release that contains the fix.
go get github.com/docker/docker@v1.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Docker to the patched version to ensure the security of the system.
Conclusion
The path traversal vulnerability in Docker (CVE-2014-9356) allows remote attackers to write to arbitrary files and bypass container protection mechanisms. To mitigate this risk, it is recommended to update Docker to version 1.3.3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/docker/docker →
FAQ
Docker is an open-source platform that automates the deployment and management of applications within containers. It provides a lightweight and efficient alternative to traditional virtualization.
A path traversal vulnerability allows an attacker to access files or directories outside the intended scope of an application. In the case of Docker, this vulnerability enables unauthorized write access to arbitrary files.
The vulnerability can be exploited by providing a full pathname in a symlink within an image or a build in a Dockerfile. By manipulating the symlink, an attacker can bypass container protection mechanisms and gain unauthorized write access to files outside the container's filesystem.
Exploiting this vulnerability can lead to unauthorized data modification or code execution. An attacker could modify critical system files or inject malicious code into the host system, compromising its integrity and potentially leading to further attacks.
To protect your system, it is crucial to update Docker to version 1.3.3 or later. This version includes a patch that addresses the path traversal vulnerability. Regularly updating Docker and other software components is essential to maintain a secure environment.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
