Vulnerability · Published Aug 19, 2026 · Assigned by GitHub_M

CVE-2026-75593BuildKit: Malicious client can bypass destination directory validation on local sources upload

High 7.2

In plain English

A high-severity path traversal in buildkit from moby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 4.0)7.2High

Exploit odds (30 days)0.5%top 54.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.

Affected products (as reported)

Vendor	Product	Versions
moby	buildkit	< 0.31.2

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/moby/buildkit/security/advisories/GHSA-g2h8-426c-7976 x_refsource_CONFIRM
https://github.com/moby/buildkit/releases/tag/v0.31.2 x_refsource_MISC