PT-2026-61984

CVE-2026-15791

Published

2026-07-21

Updated

2026-09-07

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions BuildKit (affected versions not specified)

Description A crafted message in the low-level build API allows an attacker to remove the contents of the /tmp directory. This occurs because an action intended to delete files within the build container rootfs can escape and affect the actual host temporary directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers

CVE-2026-15791

BDU:2026-15266