UpHeron
All vulnerabilities

Servers and applications

CVE-2021-41089

`docker cp` allows unexpected chmod of host files

Severity
Medium 6.3
Published
4 Oct 2021
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
20.10.9
Also known as
GHSA-v994-f8vw-g7j4
Sources
NVD, Project advisories (GitHub)

Description

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed…

Affected software

SoftwareAffected versions
Docker EngineServers and applications · cpe:a:mobyproject:moby
  • Every version before 20.10.9
Docker EngineServers and applications · github:moby/moby
  • Every version before 20.10.9

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-41089
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-41089
  • GitHub Advisory Database https://github.com/advisories/GHSA-v994-f8vw-g7j4
  • github.com https://github.com/moby/moby/security/advisories/GHSA-v994-f8vw-g7j4