v25.0.17
Security 4
- Fix CVE-2026-41568: symlink escape in mount destination creation
- Decompress archives before entering container filesystem, fixing CVE-2026-41567
- Fix CVE-2026-42306: bind mount target redirection via symlink swap during docker cp
- Vendor github.com/containerd/containerd v1.7.33 to mitigate CVE-2024-40635
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestone:
- moby/moby, 25.0.17 milestone
- Changes to the Engine API, see API version history.
Bug fixes and enhancements
- Fix CVE-2026-41568: symlink escape in mount destination creation. https://github.com/moby/moby/pull/52648
- Decompress archives before entering container filesystem, fixing CVE-2026-41567. https://github.com/moby/moby/pull/52647
- Fix CVE-2026-42306: bind mount target redirection via symlink swap during docker cp. https://github.com/moby/moby/pull/52657
- Vendor github.com/containerd/containerd v1.7.33 to mitigate CVE-2024-40635. https://github.com/moby/moby/pull/49909