Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when «umoci unpack» or «umoci raw unpack» is used.
