CVE-2026-44517

Name of the Vulnerable Software and Affected Versions Buildah versions 1.38.1 through 1.43.1 Buildah versions 1.44.0 (affected versions not specified)

Description Buildah allows a build-time breakout when processing build contexts or add/copy instructions. A malicious server supplying a Git repository or a tar archive can cause files outside the build context directory to be included in the context or copied into the build. This occurs because TempDirForURL in define/types.go does not securely confine Git repository subdirectories, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A crafted Git URL or Containerfile can trigger this unauthorized access to files outside the build context.

Recommendations Update Buildah to version 1.43.2. Update Buildah to version 1.44.