Skip to main content

Docker CVE-2026-33748

HIGH
Path Traversal (CWE-22)
2026-03-26 https://github.com/moby/buildkit GHSA-4vrq-3vrq-g6gg
Docker Path Traversal
8.2
CVSS 4.0 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
8.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Red Hat
6.5 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
Analysis Updated
Apr 20, 2026 - 12:57 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Apr 20, 2026 - 12:52 vuln.today
cvss_changed
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
Analysis Generated
Mar 26, 2026 - 18:30 vuln.today
CVE Published
Mar 26, 2026 - 18:27 nvd
HIGH 8.2

DescriptionGitHub Advisory

Impact

Insufficient validation of Git URL fragment subdir components (<url>#<ref>:<subdir>, docs) may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem.

Patches

The issue has been fixed in version v0.28.1

Workarounds

The issue affects only builds that use Git URLs with a subpath component. Avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.

AnalysisAI

Path traversal in Moby BuildKit allows remote unauthenticated attackers to read files outside Git repository roots during Docker image builds using crafted URL fragments. Affects builds using Git URLs with subdir components (e.g., git://repo#ref:subdir syntax). Exploitation probability is low (EPSS 2%, 4th percentile) with no public exploit identified at time of analysis. Vendor-released patch available in BuildKit v0.28.1.

Technical ContextAI

Moby BuildKit is the build engine used by Docker and other container platforms to construct container images from Dockerfiles. When BuildKit processes a Git URL as build context, it supports RFC-compliant URL fragment syntax to specify a Git reference and subdirectory (git://repository#branch:subdirectory). The vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) stems from insufficient validation of the subdirectory component in these URL fragments. An attacker can craft a malicious subdir value pointing to a symbolic link that references files outside the cloned repository root. Because BuildKit follows these symlinks without proper boundary checks, it exposes files on the same mounted filesystem that should be isolated from the build context. The affected component is the Go package github.com/moby/buildkit, which handles the parsing and checkout of Git-based build contexts before executing Dockerfile instructions.

RemediationAI

Upgrade Moby BuildKit to version v0.28.1 or later, available at github.com/moby/buildkit/releases/tag/v0.28.1. For Docker Desktop and Docker Engine users, apply the corresponding Docker release that bundles BuildKit v0.28.1 or later (check release notes for version mapping). If immediate patching is not feasible, implement strict input validation on Git URLs used in build contexts: specifically, prohibit or sanitize the subdir fragment component (the portion after the colon in git://url#ref:subdir syntax) when building from external or untrusted repositories. In CI/CD pipelines, restrict Git URL sources to an allowlist of trusted repositories and reject builds with subdir components from sources outside this allowlist. For high-security environments, disable Git URL build contexts entirely and require builds to use only pre-cloned local directories where filesystem boundaries can be enforced by the host OS. Note that disabling Git URL contexts may break existing build workflows that rely on this convenience feature. For SUSE Linux Enterprise environments, apply SUSE-SU-2026:1205 patch through standard update channels (zypper update).

More in Docker

View all
CVE-2024-55964 CRITICAL POC
9.8 Mar 26

An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
CVE-2019-5736 HIGH POC
8.6 Feb 11

runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
CVE-2023-32077 HIGH POC
7.5 Aug 24

Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
CVE-2026-39987 CRITICAL POC
9.3 Apr 08

Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
CVE-2023-5815 HIGH POC
8.1 Nov 22

The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
CVE-2014-9357 CRITICAL
10.0 Dec 16

Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
CVE-2026-34156 CRITICAL POC
9.9 Mar 30

Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
CVE-2019-15752 HIGH POC
7.8 Aug 28

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
CVE-2025-34221 CRITICAL POC
10.0 Sep 29

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2
CVE-2024-23054 CRITICAL POC
9.8 Feb 05

An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution du
CVE-2025-23211 CRITICAL POC
9.9 Jan 28

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
CVE-2026-46339 CRITICAL POC
10.0 May 19

Unauthenticated remote code execution in 9router (npm package) versions 0.4.30 through 0.4.36 allows network-adjacent at

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2018-13379 CRITICAL POC
9.1
CVE-2015-0016 HIGH POC
7.8

Same technique Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2015-0016 HIGH POC
7.8
CVE-2016-0752 HIGH POC
7.5
CVE-2024-13159 CRITICAL POC
9.8
CVE-2024-13160 CRITICAL POC
9.8
CVE-2024-13161 CRITICAL POC
9.8
CVE-2014-0780 CRITICAL POC
9.8
CVE-2024-48248 HIGH POC
8.6

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 12 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-33748 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy