CVE-2026-33748

Name of the Vulnerable Software and Affected Versions BuildKit versions prior to 0.28.1

Description Insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. This issue affects builds that use Git URLs with a subpath component. The vulnerable component is the handling of the subdir component within Git URLs. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.

Recommendations Update to BuildKit version 0.28.1 or later. Avoid building Dockerfiles from untrusted sources. Avoid using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.