The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname validation before extracting an archive member

A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry…