GitHub Advisoryadvisory · Go

GHSA-49p4-px3h-rq49 Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive

MEDIUM Published 2026-06-22 Modified 2026-06-22 Official page ↗
Aliases
CVE-2026-44517
Ecosystem
Go
Packages
github.com/containers/buildah
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2026-06-22

Affected packages

• Go github.com/containers/buildah: >= 1.38.1, < 1.43.2 → fixed in 1.43.2

Description

Impact When processing a build contexts or `add`/`copy` instructions, a malicious server serving a Git repository or a tar archive file can cause files outside of the build context directory to be included in the build context or copied into the build. Patches Fixed in Buildah 1.44 and 1.43.2.

Related

Alias · CVE (1)

  • CVE-2026-44517 Buildah is a tool that facilitates building OCI images. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References