CVE-2026-44517MEDIUMCVSS 6.3

Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive

Published Jun 22, 2026·Updated Jun 22, 2026

Description

### Impact When processing a build contexts or `add`/`copy` instructions, a malicious server serving a Git repository or a tar archive file can cause files outside of the build context directory to be included in the build context or copied into the build. ### Patches Fixed in Buildah 1.44 and 1.43.2.

Affected Packages (1)

github.com/containers/buildahGO
From 1.38.1
Fixed in 1.43.2

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Register your stack and get notified within minutes when a matching CVE drops.

Start monitoring free