BuildKit possible host system access from mount stub cleaner

BuildKit, a container build tool, has a critical vulnerability where a malicious build configuration can trick the cleanup process into deleting files on the host system instead of just inside the container. This allows attackers to destroy important host files if they can control the Dockerfile or build frontend.

CWE-22 path traversal vulnerability in BuildKit's mount stub cleaner: a malicious Dockerfile or frontend using RUN --mount can exploit the post-build cleanup mechanism to delete arbitrary files on the host filesystem. Exploitation requires the attacker to supply or control the Dockerfile or BuildKit frontend; impact is unrestricted host file deletion with the privileges of the BuildKit process.