Description

> in code reviewing, i found a path traversal vulnerability in docker's image converting using docker2aci, there must be a possibility that it extracts embedded layer data to arbitrary directories or paths since no essential check for file path, RCE or privilege escalation would be performed.

> it is indeed true that i tested the issue by building a malicious image, if running as root, arbitrary file could be written into arbitrary paths, like backdoors, or running as unprivileged user, arbitrary files also could be extracted to some paths within the capabilities of current user.

> It is quite critical, right ? Could you request a CVE for that ?