CVE-2026-44517: Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive ### Impact When processing a build contexts or…

medium

Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive

### Impact

When processing a build contexts or `add`/`copy` instructions, a malicious server serving a Git repository or a tar archive file can cause files outside of the build context directory to be included in the build context or copied into the build.

### Patches

Fixed in Buildah 1.44 and 1.43.2.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
github.com	containers_buildah	>= 1.38.1 < 1.43.2	1.43.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.