CVE-2026-79699

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

  • Published Sep 15, 2026
  • CVSS 4.4 medium
  • 0.2% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-79699 at the National Vulnerability Database