CVE-2026-33747 — Path Traversal in Buildkit

CWE-22 — Path Traversal21 documents6 sources
Severity
9.8CRITICALNVD
EPSS
0.1%
top 82.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Moby BuildkitGithub.com Moby BuildkitMobyproject Buildkit
Timeline
PublishedMar 27

Description

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5moby/buildkit< 0.28.1
▶NVDmobyproject/buildkit< 0.28.1

🔴Vulnerability Details

3
OSV
BuildKit's Malicious frontend can cause file escape outside of storage root in github.com/moby/buildkit↗2026-03-27
▶
GHSA
BuildKit's Malicious frontend can cause file escape outside of storage root↗2026-03-26
▶
OSV
BuildKit's Malicious frontend can cause file escape outside of storage root↗2026-03-26
▶

📋Vendor Advisories

1
Red Hat
BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend↗2026-03-27
▶

🕵️Threat Intelligence

14
Wiz
CVE-2026-23992 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-33748 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-24686 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2025-67499 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-24117 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶

💬Community

2
Bugzilla
CVE-2026-33747 doctl: BuildKit: Arbitrary file write and code execution via untrusted frontend [fedora-43]↗2026-03-27
▶
Bugzilla
CVE-2026-33747 doctl: BuildKit: Arbitrary file write and code execution via untrusted frontend [fedora-42]↗2026-03-27
▶