CVE-2021-3762: Path Traversal in claircore
Summary
CVE-2021-3762: Path traversal in github.com/quay/claircore. Affects github.com/quay/claircore versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is claircore, a Go package used in the Clair vulnerability scanner. ClairCore engine is responsible for scanning container images for vulnerabilities. It provides functionality for analyzing container layers and identifying potential security issues. However, a directory traversal vulnerability has been discovered in the ClairCore engine, allowing an attacker to exploit the system by supplying a crafted container image. This vulnerability enables arbitrary file write on the filesystem, potentially leading to remote code execution.
Vulnerability Detail
The directory traversal vulnerability in the ClairCore engine of Clair allows an attacker to bypass file system restrictions and write arbitrary files on the system. By supplying a specially crafted container image, an attacker can manipulate the scanning process and write files to unintended locations. This can result in remote code execution, enabling the attacker to execute arbitrary commands on the affected system. The vulnerability has a CVSS score of 7.8, indicating a high severity level.
How To Fix
Latest published version: v1.6.1 as of 23 Oct 2026
go get github.com/quay/claircore@v1.6.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.0
This is the first release that contains the fix.
go get github.com/quay/claircore@v1.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the claircore package to the fixed versions as mentioned above.
Conclusion
In conclusion, the directory traversal vulnerability in claircore can lead to arbitrary file write and potential remote code execution. It is crucial to update the claircore package to the fixed versions mentioned above to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/quay/claircore →
FAQ
The vulnerability allows an attacker to write arbitrary files on the system, potentially leading to remote code execution. This can result in unauthorized access, data theft, or system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is crucial to update the claircore package to the fixed versions to mitigate the risk.
Yes, the CVSS score for this vulnerability is 7.8, indicating a high severity level.
You can find more information about this vulnerability, including the advisory and fixed versions, at the following source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-mq47-6wwv-v79w/GHSA-mq47-6wwv-v79w.json
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/quay/claircore.
