IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
8.4Yüksek

CVE-2026-33747BuildKit vulnerable to malicious frontend causing file escape outside of storage root

moby buildkit Yayım: (7 ay önce)

Açıklama

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.

Zayıflık türü (CWE): CWE-22

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
moby buildkit < 0.28.1
mobyproject buildkit < 0.28.1

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (1)
  • cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:* < 0.28.1

Aynı üründe son açıklar — Docker / Moby

6.7Orta
CVE-2026-121522

Possible panic from Git source resolver

moby BuildKit

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.