CVE-2026-33748highCWE-22CWE-59

CVE-2026-33748: high-severity vulnerability in moby buildkit

BuildKit Git URL subdir component can cause access to restricted files

Published

Follow this CVE+ Monitor BuildKit+ Monitor docker.io

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.5%
In short

BuildKit doesn't properly validate the subdir component in Git URLs, allowing attackers to access files outside the intended repository directory. This could expose sensitive files on the same filesystem during container builds.

Technical detail

Insufficient validation of Git URL fragment subdir components enables path traversal (CWE-22) and symlink following (CWE-59), allowing unauthorized file access beyond the repository root during build operations. The attack vector requires builds using Git URLs with subpath components; impact is limited to files on the same mounted filesystem.

Summary generated and translated by AI from the official description.
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
moby · buildkit
Related CVEs — moby buildkit

In the same product, most dangerous first.

CVE-2024-23653CRITICALBuildKit interactive containers API does not validate entitlements checkEPSS 3.4%CVE-2024-23652CRITICALBuildKit possible host system access from mount stub cleanerEPSS 2.5%CVE-2024-23650MEDIUMBuildKit possible panic when incorrect parameters sent from frontendEPSS 1.1%CVE-2023-26054MEDIUMCredentials inlined to Git URLs could end up in provenance attestation in BuildKitEPSS 1.0%CVE-2024-23651HIGHBuildKit possible race condition with accessing subpaths from cache mountsEPSS 0.9%CVE-2026-75593HIGHBuildKit: Malicious client can bypass destination directory validation on local sources uploadEPSS 0.5%