CVE-2021-41089

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-281

Affected software

No affected versions have been published.

Timeline

Published: Oct 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-410907.5Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to ve CVE-2021-410916.3Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data CVE-2021-410927.5Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-CVE-2021-410939.8Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an ac CVE-2021-410944.6Wire is an open source secure messenger. Users of Wire by Bund may bypass the mandatory encryption at rest feature by simply disabling their CVE-2021-410956.1Discourse is an open source discussion platform. There is a cross-site scripting (XSS) vulnerability in versions 2.7.7 and earlier of the `s CVE-2021-410967.5Rucky is a USB HID Rubber Ducky Launch Pad for Android. Versions 2.2 and earlier for release builds and versions 425 and earlier for nightly CVE-2021-410977.5aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in a CVE-2021-410987.5Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on CVE-2021-410997.5Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the underlying string library can be used to c CVE-2021-41107.5mruby is vulnerable to NULL Pointer Dereference CVE-2021-411009.8Wire-server is the backing server for the open source wire secure messaging application. In affected versions it is possible to trigger emai