CVE-2026-44517
Buildah: Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A malicious server supplying a Git repository or tar archive can cause files outside the build context directory to be included in the context or copied into the build. This issue is fixed in versions 1.43.2 and 1.44.0.
| CWE | CWE-22 |
| Vendor | containers |
| Product | buildah |
| Published | Aug 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for containers buildah
Be the first to know when new medium vulnerabilities affecting containers buildah are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
containers / buildah
>= 1.38.1, < 1.43.2
References
github.com: https://github.com/podman-container-tools/buildah/security/advisories/GHSA-49p4-px3h-rq49 github.com: https://github.com/podman-container-tools/buildah/commit/54459cf8a0feb4b1da766e4a6360451834e1846c github.com: https://github.com/podman-container-tools/buildah/commit/fc2003bb2efeb3ed7d5c7e1e88d04e78f370a944 github.com: https://github.com/podman-container-tools/buildah/releases/tag/v1.43.2 github.com: https://github.com/podman-container-tools/buildah/releases/tag/v1.44.0