BuildKit: Insufficient validation of git URL fragment subdir allows access to files outside the intended checkout

Impact

Insufficient validation of git URL fragment subdir allows access to files outside the intended checkout

Who can reach it

Anyone who can submit a build

What to do

Upgrade BuildKit to 0.28.1+

References

Related entries

• BuildKit: git.checkoutbundle=true on a malicious git source yields crafted command invocation on the build hostCVE-2026-15793 · BuildKitHigh
• BuildKit: Crafted upload request lets files escape the BuildKit state directory onto the hostCVE-2026-15789 · BuildKitMedium
• BuildKit: Git URL credentials in a build request are persisted into the build cache and can be read by other buildsCVE-2023-26054 · BuildKitMedium
• BuildKit: Malicious client or frontend panics the BuildKit daemonCVE-2026-15792 · BuildKitMedium
• BuildKit: NTFS junctions inside the cache root escape the cache mount on Windows container workersCVE-2026-15788 · BuildKitMedium
• BuildKit: Malicious client or frontend crashes the BuildKit daemonCVE-2024-23650 · BuildKitMedium