Vulnerability · Published Mar 27, 2026 · Assigned by GitHub_M
CVE-2026-33748BuildKit Git URL subdir component can cause access to restricted files
High 8.2
In plain English
A high-severity path traversal in buildkit from moby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | buildkit | 0.29.0-r0 | ALPINE-CVE-2026-33748 |
| Alpine:v3.23 | docker | 29.3.1-r0 | ALPINE-CVE-2026-33748 |
| Alpine:v3.24 | docker | 29.3.1-r0 | ALPINE-CVE-2026-33748 |
| Debian:12 | docker.io | no fix listed | DEBIAN-CVE-2026-33748 |
| Debian:13 | docker.io | 26.1.5+dfsg1-9+deb13u1 | DEBIAN-CVE-2026-33748 |
| Debian:14 | docker.io | 28.5.2+dfsg4-3 | DEBIAN-CVE-2026-33748 |
| Go | github.com/moby/buildkit | 0.28.1 | GHSA-4vrq-3vrq-g6gg |
| Go | github.com/moby/buildkit | 0.28.1 | GO-2026-4859 |
| Ubuntu:25.10 | docker.io | no fix listed | UBUNTU-CVE-2026-33748 |
| Ubuntu:26.04:LTS | docker.io | no fix listed | UBUNTU-CVE-2026-33748 |
| Ubuntu:26.10 | docker.io | no fix listed | UBUNTU-CVE-2026-33748 |
| Ubuntu:22.04:LTS | docker.io-app | 29.1.3-0ubuntu3~22.04.2 | UBUNTU-CVE-2026-33748 |
| Ubuntu:24.04:LTS | docker.io-app | 29.1.3-0ubuntu3~24.04.2 | UBUNTU-CVE-2026-33748 |
| Ubuntu:25.10 | docker.io-app | no fix listed | UBUNTU-CVE-2026-33748 |
| Ubuntu:26.04:LTS | docker.io-app | 29.1.3-0ubuntu4.1 | UBUNTU-CVE-2026-33748 |
| Ubuntu:26.10 | docker.io-app | 29.1.3-0ubuntu5 | UBUNTU-CVE-2026-33748 |
Affected products (as reported)
Weakness: CWE-22, CWE-59 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg x_refsource_CONFIRM
- https://docs.docker.com/build/concepts/context/#url-fragments x_refsource_MISC
- https://github.com/moby/buildkit/releases/tag/v0.28.1 x_refsource_MISC