CVE-2026-33748: BuildKit Git URL subdir component can cause access to restricted files
Analyzed
AliasesUBUNTU-CVE-2026-33748DEBIAN-CVE-2026-33748CGA-22q7-5vgc-fvcpCGA-2c4p-j6cx-fvcqCGA-2v3c-6w4q-mp3fCGA-3p67-x236-hxw6CGA-3phx-fjq2-rh4pCGA-3rv8-gg58-97m8CGA-4g7x-vx7r-6m2qCGA-4hgf-2mxc-p4qmCGA-4p7m-h98h-rvmgCGA-4rhf-hv6q-qpv8CGA-5wv5-4ff8-2x2xCGA-73wm-q8xc-gmvjCGA-7g22-vhx8-w399CGA-832p-fwp8-5c2jCGA-842q-46c8-5prxCGA-8644-qfwg-qqqvCGA-8gpv-fx6q-vhmvCGA-9mw8-xg42-w399CGA-c6w9-8xj5-g87jCGA-cq84-g875-769qCGA-f5j4-98g8-5pq7CGA-fj9j-mhm9-fg65CGA-g24w-c25q-gw29CGA-g73q-9jpx-63rfCGA-j85f-5cjm-68rvCGA-jfvv-hg4v-8rfqCGA-pf2m-898h-cq56CGA-q7q3-2g2r-v5gfCGA-qmj7-hmvp-3552CGA-r3p8-f7gg-fwcrCGA-rc8p-cgj7-pjwwCGA-rwc9-742w-88w6CGA-v4xp-vvrm-m6w4CGA-v9fp-rxx6-273mCGA-vhjp-8v95-jxg2CGA-vv75-8q4f-gvc6CGA-vv8m-hc4m-88hxCGA-xhhr-p3vg-56gqGHSA-4vrq-3vrq-g6ggGO-2026-4859CGA-2cgm-qm6j-46r9CGA-2rmx-jhvc-xjc9CGA-35jw-jgxq-v97cCGA-3f5v-jwhm-73q7CGA-3p3g-wvqh-mmrrCGA-49cm-c4h2-8f4jCGA-4jfw-rp5w-3rv7CGA-52w8-q95g-9pjjCGA-57m9-mm75-cpf3CGA-5gcm-q2qw-2r34CGA-5w4x-r7rr-ghvwCGA-65pg-2hx8-pmq8CGA-69g4-78r3-9mv5CGA-7679-5wfq-c7p8CGA-7888-w24p-xhxgCGA-7g28-2v97-ghcqCGA-7hm2-4j4p-w5qfCGA-7q56-g4g6-c35wCGA-8466-595v-cpgqCGA-8mj4-2c46-c5mxCGA-8pc3-vp32-949cCGA-9pff-5r49-jghrCGA-9w32-6hxw-qhmxCGA-9xqm-mf62-v5gwCGA-c59m-85f4-463hCGA-c934-qxcw-9cxwCGA-cr5v-28f8-ph3jCGA-cwrw-vhp6-w28gCGA-f433-6wfj-3xxxCGA-f6qj-q299-mjfxCGA-f6w3-v4xm-f363CGA-f8mr-8v9h-prf8CGA-fgjw-c36w-2674CGA-fhjv-jgrq-jqqcCGA-g3r5-7j5q-385cCGA-gmmg-w4cm-mh42CGA-grgh-7jrj-w8rgCGA-gwm4-xg4h-778cCGA-h795-ghmx-6cf4CGA-h7jv-xqqf-xjqfCGA-hjrv-v9g9-2fh9CGA-j2p5-q9mj-x7hhCGA-jj35-wj2w-p27xCGA-jm6j-2xm7-xwj3CGA-jxcr-rq6c-rgfcCGA-jxqx-mvr8-8x69CGA-m9rr-f243-8m2vCGA-mx33-qvvx-9qp5CGA-p2m7-5392-8fr5CGA-pr3x-9hjj-prfmCGA-q3p9-rrf5-x5w4CGA-qfpp-7hr7-644wCGA-qw96-vj55-j3p8CGA-r54h-j9h8-44jrCGA-r66m-328x-4wjgCGA-rmfq-cpxr-jr97CGA-vm28-5cgw-897qCGA-w45f-x57r-xrvwCGA-w88g-vrw9-m936CGA-wcjc-jgvg-5p6cCGA-wgjm-vjxr-hqpvCGA-wj8f-fh6p-g2x7CGA-wxcx-q7rx-mjf6CGA-x422-f27r-6fvrCGA-xc7q-38gc-689cCGA-xcgw-3fv4-343rCGA-xgjx-w58q-538gCGA-xr38-58f5-g3q7CGA-xrhf-vx7c-fvw9ALPINE-CVE-2026-33748
Published 27-03-2026Last modified 27-03-2026
Vulnerability summary
CVE-2026-33748 is a high (CVSS 8.2) vulnerability in moby buildkit. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 41.5% of scored vulnerabilities.
Priority
Prioritisesevere
Severe, CVSS 8.2 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?CVSS score
8.2/10
010
High · v4.0 (CVE.org)EPSS score
0.48%
0%100%
Low · -0.05 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 5 · Related 7Timeline
- 27-03-2026PublishedVulnerability first disclosed.
- 27-03-2026Last modifiedVulnerability information updated.
Description
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.
CVSS metrics
11 scores · 8 sources · 2 versionsHigh 8.2Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · GoEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- NVDNIST8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 5 agree
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · GoEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.48%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
Decrease -0.05 pp
From 0.53% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CWE-59Improper Link Resolution Before File AccessThe product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Affected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard51 products
- buildah< 1.44.0-r0
- buildah-fips< 1.44.0-r0
- cloudbeat-8.17All versions (No fix recorded)
- cloudbeat-8.18All versions (No fix recorded)
- cloudbeat-8.19< 8.19.13-r2
Wolfi18 products
- buildah< 1.44.0-r0
- conftest< 0.67.1-r2
- docker-cli-buildx< 0.32.1-r3
- docker-compose< 5.1.1-r1
- dockerd-28All versions (No fix recorded)
Alpine2 products
- buildkit< 0.29.0-r0
- docker< 29.3.1-r0
Ubuntu2 products
- docker.ioAll versions (No fix recorded)
- docker.io-app< 26.1.3-0ubuntu1~20.04.1+esm2 | < 29.1.3-0ubuntu3~22.04.2 | < 29.1.3-0ubuntu3~24.04.2 | All versions (No fix recorded) | < 29.1.3-0ubuntu5 | < 29.1.3-0ubuntu4.1
Debian1 product
- docker.ioAll versions (No fix recorded) | < 26.1.5+dfsg1-9+deb13u1 | < 28.5.2+dfsg4-3
Github.com/moby1 product
- buildkit< 0.28.1
Moby1 product
- buildkit< 0.28.1
Mobyproject1 product
- buildkit< 0.28.1
8 vendors · 77 products
References
11 links- github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6ggX Refsource CONFIRMREPORTAdvisoryWEBMitigationVendor Advisory
- github.com/moby/buildkitPACKAGE