Bug 2452271 (CVE-2026-33748)

Summary:	CVE-2026-33748 github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	adudiak, alcohan, anjoseph, bdettelb, crizzo, derez, dfreiber, dhanak, doconnor, drosa, drow, dschmidt, dsimansk, dymurray, eglynn, erezende, gparvin, ibolton, jbalunas, jburrell, jcantril, jjoyce, jkoehler, jlanda, jmatthew, jmontleo, jprabhak, jsamir, jschluet, kbempah, kingland, kshier, kverlaen, lball, lgamliel, lhh, ljawale, lphiri, luizcosta, manissin, mburns, mgarciac, mnovotny, ngough, nweather, pahickey, pakotvan, pgaikwad, rbobbitt, rfreiman, rhaigner, rjohnson, rojacob, sakbas, sausingh, sdawley, simaishi, slucidi, smcdonal, solenoci, sseago, stcannon, sthirugn, teagle, veshanka, vkumar, whayutin, wtam, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in BuildKit. Insufficient validation of Git URL fragment subdirectory components may allow a remote attacker to access files outside the checked-out Git repository root. This access is limited to files on the same mounted filesystem. This vulnerability could lead to unauthorized information disclosure.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2453083, 2453084, 2453085, 2453086, 2453089, 2453090, 2453091, 2453092, 2453093, 2453094, 2453095, 2453087, 2453088
Bug Blocks:

Description OSIDB Bzimport 2026-03-27 15:02:23 UTC

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.