EUVD-2026-62839
GHSA-wqjv-cjqw-p7p5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable daemon requiring low-privilege API credentials; scope change applies because path traversal escapes BuildKit's sandbox to the underlying host filesystem.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.
AnalysisAI
Path traversal in BuildKit prior to v0.31.2 enables an authenticated API client to escape the daemon's controlled state directory by submitting a crafted upload request containing traversal sequences. Affected parties include any deployment where multiple principals share BuildKit API access - such as multi-tenant CI/CD infrastructure or shared Docker build environments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker possess valid credentials or permissions to access the BuildKit control API and issue build requests - explicitly stated in the CVE description ('The client needs to have valid permissions to access BuildKit control API to issue builds'). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H) scores 7.2 and accurately captures a network-reachable, low-complexity flaw requiring only authenticated low-privilege API access, with no user interaction needed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds a valid BuildKit API token in a shared CI/CD environment crafts a malicious build-context upload request embedding path traversal sequences - for example, targeting ../../etc/cron.d/ - causing the BuildKit daemon to write attacker-controlled file content to a host cron directory. No public POC has been identified at time of analysis, but the attack pattern is well-understood for CWE-22 class vulnerabilities and would be straightforward to implement given API documentation. |
| Remediation | Upgrade BuildKit to version 0.31.2 or later; the patched release and changelog are at https://github.com/moby/buildkit/releases/tag/v0.31.2, and the advisory at https://github.com/moby/buildkit/security/advisories/GHSA-g2h8-426c-7976 provides additional context. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all BuildKit deployments and identify instances serving multiple API clients or teams. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today