CVE-2026-44517
published 2026-08-21CVE-2026-44517: Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git…
PriorityP428medium6.3CVSS 3.1
AVLACLPRNUIRSCCHINAN
EPSS
0.18%
7.9th percentile
Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A malicious server supplying a Git repository or tar archive can cause files outside the build context directory to be included in the context or copied into the build. This issue is fixed in versions 1.43.2 and 1.44.0.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| buildah_project | buildah | — | — |
| containers | buildah | — | — |
| devspaces | udi-base-rhel10 | — | — |
| devspaces | udi-base-rhel9 | — | — |
| devspaces | udi-rhel9 | — | — |
| github.com | containers_buildah | >= 1.38.1 < 1.43.2 | 1.43.2 |
| openshift4 | microshift-bootc-rhel10 | — | — |
| openshift4 | oc-mirror-plugin-rhel9 | — | — |
| openshift4 | ose-docker-builder-rhel9 | — | — |
| openshift4 | ose-machine-config-rhel9-operator | — | — |
| podman_project | podman | — | — |
| quay | quay-builder-rhel8 | — | — |
| quay | quay-builder-rhel9 | — | — |
| rhcertification | redhat-certification-system-ai-10 | — | — |
| rhoso-operators | prometheus-podman-exporter-rhel9 | — | — |
| ubi9 | buildah | — | — |
CVSS provenance
nvdv3.16.3MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
containers Buildah up to 1.43.1 Git Repository Subdirectory define/types.go TempDirForURL symlink
vuldb·2026-08-21·CVSS 6.3
CVE-2026-44517 [MEDIUM] containers Buildah up to 1.43.1 Git Repository Subdirectory define/types.go TempDirForURL symlink
A vulnerability classified as critical has been found in containers Buildah up to 1.43.1. This issue affects the function TempDirForURL of the file define/types.go of the component Git Repository Subdirectory. The manipulation leads to symlink following.
This vulnerability is documented as CVE-2026-44517. The attack can be initiated remotely. There is not any exploit available.
It is recommended to upgrade the affected component.
GHSA
Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive
ghsa·2026-06-22
CVE-2026-44517 [MEDIUM] CWE-22 Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive
Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive
### Impact
When processing a build contexts or `add`/`copy` instructions, a malicious server serving a Git repository or a tar archive file can cause files outside of the build context directory to be included in the build context or copied into the build.
### Patches
Fixed in Buildah 1.44 and 1.43.2.
Red Hat
github.com/containers/buildah: Buildah: Build breakout via malicious Git repository or tar archive
vendor_redhat·2026-08-21·CVSS 6.3
CVE-2026-44517 [MEDIUM] CWE-22 github.com/containers/buildah: Buildah: Build breakout via malicious Git repository or tar archive
github.com/containers/buildah: Buildah: Build breakout via malicious Git repository or tar archive
Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A malicious server supplying a Git repository or tar archive can cause files outside the build context directory to be included in the context or copied into the build. This issue is fixed in versions 1.43.2 and 1.44.0.
A flaw was found in Buildah. Insecure handling of temporary directories and symlinks during the image build process, specifically within `TempDi
No detection rules found.
No public exploits indexed.
https://github.com/podman-container-tools/buildah/commit/54459cf8a0feb4b1da766e4a6360451834e1846chttps://github.com/podman-container-tools/buildah/commit/fc2003bb2efeb3ed7d5c7e1e88d04e78f370a944https://github.com/podman-container-tools/buildah/releases/tag/v1.43.2https://github.com/podman-container-tools/buildah/releases/tag/v1.44.0https://github.com/podman-container-tools/buildah/security/advisories/GHSA-49p4-px3h-rq49
2026-08-21
Published