UpHeron
All vulnerabilities

Servers and applications

CVE-2021-41091

Insufficiently restricted permissions on data directory

Severity
Medium 6.3
Published
4 Oct 2021
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
20.10.9
Also known as
GHSA-3fwx-pjgw-3558
Sources
NVD, Project advisories (GitHub)

Description

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with…

Affected software

SoftwareAffected versions
Docker EngineServers and applications · cpe:a:mobyproject:moby
  • Every version before 20.10.9
Docker EngineServers and applications · github:moby/moby
  • Every version before 20.10.9

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-41091
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-41091
  • GitHub Advisory Database https://github.com/advisories/GHSA-3fwx-pjgw-3558
  • github.com https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558