Vulnerability GO-2026-5116

Unknown

3 months ago

Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah

v1.38.1 - v1.46.0

Summary

Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah

Details

Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation.

References

ADVISORY — github.com

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Medium Risk

4 months ago

Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive

v1.38.1 - v1.43.1 GHSA-49p4-px3h-rq49

Unknown

1 year ago

Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah

v0.16.0 - v1.33.11 and v1.35.0 - v1.35.4 and v1.37.0 - v1.37.5 and v1.38.0 GO-2025-3414

High Risk

1 year ago

Buildah allows build breakout using malicious Containerfiles and concurrent builds

v0.16.0 - v1.33.11 and v1.35.0 - v1.35.4 and v1.37.0 - v1.37.5 and v1.38.0 GHSA-5vpc-35f4-r8w6

Unknown

2 years ago

Buildah allows arbitrary directory mount in github.com/containers/buildah

v0.16.0 - v1.37.0 GO-2024-3186

Unknown

2 years ago

Improper Input Validation in Buildah and Podman in github.com/containers/buildah

v0.16.0 - v1.37.3 GO-2024-3169

View all vulnerabilities for these packages

Impacted packages

github.com/containers/buildah

Timeline

Published

3 months ago

Last Modified

3 months ago