CVE-2026-44517

Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A malicious server supplying a Git repository or tar archive can cause files outside the build context directory to be included in the context or copied into the build. This issue is fixed in versions 1.43.2 and 1.44.0.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 4.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/podman-container-tools/buildah/commit/54459cf8a0feb4b1da766e4a6360451834e1846c
https://github.com/podman-container-tools/buildah/commit/fc2003bb2efeb3ed7d5c7e1e88d04e78f370a944
https://github.com/podman-container-tools/buildah/releases/tag/v1.43.2
https://github.com/podman-container-tools/buildah/releases/tag/v1.44.0
https://github.com/podman-container-tools/buildah/security/advisories/GHSA-49p4-px3h-rq49

Configurations

No configuration.

History

12 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Buildah es una herramienta que facilita la creación de imágenes OCI. Desde la versión 1.38.1 hasta la 1.43.2 y la 1.44.0, TempDirForURL en define/types.go no confina de forma segura los subdirectorios del repositorio Git al contexto de construcción descargado, y downloadToDirectory y stdinToDirectory pueden seguir un enlace simbólico de Dockerfile dejado por un archivo tar parcialmente extraído. Un servidor malicioso que suministra un repositorio Git o un archivo tar puede hacer que los archivos fuera del directorio del contexto de construcción se incluyan en el contexto o se copien en la construcción. Este problema está corregido en las versiones 1.43.2 y 1.44.0.

Information

Published : 2026-08-21 21:16

Updated : 2026-10-12 16:10

NVD link : CVE-2026-44517

Mitre link : CVE-2026-44517

CVE.ORG link : CVE-2026-44517

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-44517", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44517", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T17:05:33.478033Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "containers", "product": "buildah", "versions": [{"status": "affected", "version": ">= 1.38.1, < 1.43.2"}]}]}], "published": "2026-08-21T21:16:59.250", "references": [{"url": "https://github.com/podman-container-tools/buildah/commit/54459cf8a0feb4b1da766e4a6360451834e1846c", "source": "security-advisories@github.com"}, {"url": "https://github.com/podman-container-tools/buildah/commit/fc2003bb2efeb3ed7d5c7e1e88d04e78f370a944", "source": "security-advisories@github.com"}, {"url": "https://github.com/podman-container-tools/buildah/releases/tag/v1.43.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/podman-container-tools/buildah/releases/tag/v1.44.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/podman-container-tools/buildah/security/advisories/GHSA-49p4-px3h-rq49", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A malicious server supplying a Git repository or tar archive can cause files outside the build context directory to be included in the context or copied into the build. This issue is fixed in versions 1.43.2 and 1.44.0."}, {"lang": "es", "value": "Buildah es una herramienta que facilita la creaci\u00f3n de im\u00e1genes OCI. Desde la versi\u00f3n 1.38.1 hasta la 1.43.2 y la 1.44.0, TempDirForURL en define/types.go no confina de forma segura los subdirectorios del repositorio Git al contexto de construcci\u00f3n descargado, y downloadToDirectory y stdinToDirectory pueden seguir un enlace simb\u00f3lico de Dockerfile dejado por un archivo tar parcialmente extra\u00eddo. Un servidor malicioso que suministra un repositorio Git o un archivo tar puede hacer que los archivos fuera del directorio del contexto de construcci\u00f3n se incluyan en el contexto o se copien en la construcci\u00f3n. Este problema est\u00e1 corregido en las versiones 1.43.2 y 1.44.0."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "security-advisories@github.com"}