Moderate severityNVD Advisory· Published Dec 16, 2014· Updated May 6, 2026

CVE-2014-9358

Description

Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/docker/dockerGo	< 1.3.2	1.3.2

Affected products

Docker/Docker
cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:*
Range: <=1.3.2

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/advisories/GHSA-qmmc-jppf-32wvghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2014-9358ghsaADVISORY
www.securityfocus.com/archive/1/534215/100/0/threadednvdWEB
access.redhat.com/security/cve/cve-2014-9358ghsaWEB
groups.google.com/forum/ghsaWEB
groups.google.com/forum/nvdWEB
web.nvd.nist.gov/view/vuln/detailghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000