GHSA-49p4-px3h-rq49

ghsaUSosv

Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive

view advisory published 2026-06-22Licence: CC-BY-4.0

### Impact When processing a build contexts or `add`/`copy` instructions, a malicious server serving a Git repository or a tar archive file can cause files outside of the build context directory to be included in the build context or copied into the build. ### Patches Fixed in Buildah 1.44 and 1.43.2.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-44517US	—	0.18% (8th)	—	2026-08-21
Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectorie…

references

External citations — patches, advisories, analysis.

https://github.com/containers/buildah/security/advisories/GHSA-49p4-px3h-rq49WEB
https://github.com/podman-container-tools/buildahPACKAGE
https://github.com/podman-container-tools/buildah/security/advisories/GHSA-49p4-px3h-rq49WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan