6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44517

CVE-2026-44517: Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive

Impact

When processing a build contexts or add/copy instructions, a malicious server serving a Git repository or a tar archive file can cause files outside of the build context directory to be included in the build context or copied into the build.

Patches

Fixed in Buildah 1.44 and 1.43.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44517

CVE-2026-44517:

6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/containers/buildah	go	>= 1.38.1, < 1.43.2	1.43.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue within the Buildah container image builder. It can be triggered when processing build contexts from a malicious Git repository or a specially crafted tar archive. The root cause is the improper handling of file paths and symlinks in several key functions responsible for managing build contexts.

The analysis of the security patch applied in version 1.43.2 reveals three vulnerable functions in the define package:

define.TempDirForURL: This function was vulnerable because it used the standard filepath.Join to construct paths when dealing with Git repositories. This did not properly sanitize against path traversal attacks using symlinks within the repository, potentially allowing an attacker to force the build process to use a context from an unintended location.
define.downloadToDirectory: This function handles downloading build contexts from URLs. It had a fallback mechanism to treat content as a raw Dockerfile if it wasn't a tar archive. The vulnerability lay in writing this Dockerfile. If a previously processed (and malicious) tar archive created a symlink named Dockerfile pointing outside the build directory, this function would follow it, allowing an attacker to write a file to an arbitrary location on the host system.
define.stdinToDirectory: This function processes build contexts from standard input and was vulnerable in the same way as downloadToDirectory. A malicious tar archive from stdin could create a symlink that would be followed when the function attempted to write a fallback Dockerfile.

The patch addresses these issues by introducing securejoin.SecureJoin for safe path construction in TempDirForURL and by using a new writeFileInRoot helper function (which utilizes os.OpenRoot) in downloadToDirectory and stdinToDirectory to prevent writing files outside the intended directory, effectively mitigating the symlink-based path traversal.

Vulnerable functions

define.TempDirForURL

define/types.go

The `TempDirForURL` function is responsible for creating a temporary directory for build contexts from a given URL. When processing a git repository, it constructs a path to a subdirectory. The original implementation used `filepath.Join`, which is vulnerable to path traversal if the git repository contains a symlink in its structure. An attacker could craft a malicious git repository that, when used as a build context, would cause files to be accessed or created outside of the intended temporary directory.

define.downloadToDirectory

define/types.go

The `downloadToDirectory` function downloads content from a URL. If the downloaded content is not a valid tar archive, it is treated as a Dockerfile and written to the build context directory. The original implementation would write this file without checking for pre-existing symlinks. If a malicious, partially extracted tar archive had previously created a symlink named `Dockerfile` pointing to a location outside the build directory, this function would follow that symlink and overwrite an arbitrary file on the filesystem.

define.stdinToDirectory

define/types.go

The `stdinToDirectory` function handles build contexts provided via standard input. Similar to `downloadToDirectory`, if the input is not a valid tar archive, it is treated as a Dockerfile. This function was vulnerable to the same symlink path traversal attack. A malicious tar archive provided via stdin could create a symlink, causing the fallback Dockerfile to be written to an arbitrary location on the filesystem.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.