BuildKit vulnerable to malicious frontend causing file escape outside of storage root

BuildKit allows malicious custom frontends to write files outside their intended storage directory, potentially compromising the system. This happens when untrusted frontends are used with specific BuildKit options.

A path traversal vulnerability (CWE-22) in BuildKit's frontend processing allows an attacker controlling a custom frontend image to craft API messages that escape the execution context's state directory. The attack requires the victim to use an untrusted frontend via `#syntax` directive or `--build-arg BUILDKIT_SYNTAX`; standard frontends like `docker/dockerfile` are not vulnerable. Successful exploitation enables arbitrary file write outside the storage root, potentially leading to privilege escalation or system compromise.