EUVD-2026-46309Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local socket access with low privileges required; high integrity and availability impact from unrestricted file writes; no confidentiality impact per description and CVSS 4.0 VC:N.
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (Docker).
CVSS VectorVendor: Docker
Lifecycle Timeline
3DescriptionCVE.org
A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc.
AnalysisAI
Path traversal in the BuildKit daemon allows a client with valid control API access to craft a malicious upload request that writes files outside the BuildKit-controlled state directory, breaking container build sandbox boundaries. Affected products span all tracked versions of moby/buildkit per CPE data, and the vulnerability carries a CVSS 4.0 score of 6.9 with high integrity and availability impact on the vulnerable system. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
BuildKit (CPE: cpe:2.3:a:moby:buildkit:*:*:*:*:*:*:*:*) is Moby's next-generation container image build engine, used as the backend for 'docker buildx' and many CI/CD pipelines. It exposes a gRPC-based control API (buildkitd daemon) through which clients submit build contexts and transfer files. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) identifies the root cause: upload request paths are not sufficiently sanitized, so traversal sequences (e.g., '../') can resolve to locations outside the daemon's designated state directory. This breaks the file-system isolation that BuildKit relies on to safely handle untrusted build inputs.
RemediationAI
Consult the Docker/Moby security advisory at https://github.com/moby/buildkit/security/advisories/GHSA-g2h8-426c-7976 for the exact patched release version - a specific fix version was not independently confirmed from available input data. Upstream fix availability should be assumed pending advisory review. As a compensating control, restrict access to the BuildKit daemon socket (typically /run/buildkit/buildkitd.sock) to only trusted, explicitly authorized users or service accounts, reducing the population of principals capable of issuing crafted upload requests. In Kubernetes environments, enforce pod security admission policies that limit which workloads can mount the BuildKit socket. Avoid exposing the buildkitd gRPC endpoint over a network interface without mutual TLS authentication, since the daemon's local socket model is the primary intended isolation boundary.
Moby is an open source container framework developed by Docker Inc. Rated high severity (CVSS 8.7), this vulnerability i
Moby is an open source container framework developed by Docker Inc. Rated medium severity (CVSS 6.8), this vulnerability
moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger mult
An issue was discovered in Docker Moby before 17.06.0. Rated high severity (CVSS 7.5), this vulnerability is remotely ex
Argument injection in Moby BuildKit lets a malicious Git source trigger crafted command invocation on the build host whe
Tar extraction path traversal in moby/go-archive allows an attacker who controls archive contents to create or overwrite
Moby) is an open source container framework developed by Docker Inc. Rated medium severity (CVSS 6.8), this vulnerabilit
moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. Rated medium severity (
moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go. Rated medium severi
Moby is an open-source project created by Docker to enable software containerization. Rated medium severity (CVSS 6.3),
Moby is an open-source project created by Docker to enable software containerization. Rated medium severity (CVSS 6.3),
Moby is an open-source project created by Docker to enable software containerization. Rated medium severity (CVSS 6.3),
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Micro 6.0 | Affected |
| SUSE Linux Micro 6.1 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today