---
id: CVE-2014-6407
aliases:
  - GHSA-5qgp-p5jc-w2rm
  - GO-2022-0630
title: Arbitrary Code Execution in Docker
summary: Arbitrary Code Execution in Docker
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'
vendor: docker
product: github.com/docker/docker
ecosystem: go
affected:
  - github.com/docker/docker < 1.3.2
patched:
  - github.com/docker/docker 1.3.2
published: '2022-02-15'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:16.875720177Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-5qgp-p5jc-w2rm'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2014-6407'
  - url: >-
      https://github.com/docker/docker/commit/3ac6394b8082d4700483d52fbfe54914be537d9e
  - url: 'https://docs.docker.com/v1.3/release-notes'
  - url: >-
      https://lists.fedoraproject.org/pipermail/package-announce/2014-December/145154.html
  - url: >-
      https://lists.opensuse.org/opensuse-security-announce/2014-12/msg00009.html
  - url: 'https://secunia.com/advisories/60171'
  - url: 'https://secunia.com/advisories/60241'
  - url: 'https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6407'
  - url: 'https://www.openwall.com/lists/oss-security/2014/11/24/5'
tags:
  - osv
  - go
epss: 0.04909
epssPercentile: 0.9172
ingestedAt: '2026-09-12T03:13:01.756Z'
---

## Overview

Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.

## Affected packages

- `github.com/docker/docker < 1.3.2`

## Remediation

Upgrade to a patched release:

- `github.com/docker/docker 1.3.2`