CVE-2014-6407High· 7.5▾ TwilightDocker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
4.9%
7.5 → 7.3
7.3 → 7.5
7.5 → 7.3
7.3 → 7.5
7.5 → 7.3
7.3 → 7.5
7.5 → 7.3
7.3 → 7.5
7.5 → 7.3
7.3 → 7.5
7.5 → 7.3
7.3 → 7.5
Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.
docker <= 1.3.1docker = 1.0.0docker = 1.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77179Critical· 9.4On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path
CVE-2026-114409Medium· 5.7Docker Desktop logs can expose stored third-party credentials
CVE-2026-105445Critical· 9.4An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rot…
CVE-2026-106581High· 8.2Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package
CVE-2026-105570Medium· 6.7Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while request routing treated DNS hostnames case-insensitively
CVE-2026-105452Medium· 5.9Docker Sandboxes could forward a client-supplied credential alongside a credential injected by the host egress proxy