FlawAtlas
Search the atlas
CVE-2026-33747 High

BuildKit's Malicious frontend can cause file escape outside of storage root

### Impact When using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. ### Patches The issue has been fixed in v0.28.1+ ### Workarounds Issue requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.

Exploit probability 0.5%
Published March 26, 2026
Required by Not available
Last source change March 27, 2026

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown

168 explicit affected versions

Go github.com/moby/buildkit
Go github.com/moby/buildkit

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities GO-2026-4858

BuildKit's Malicious frontend can cause file escape outside of storage root in github.com/moby/buildkit

View original source
Open Source Vulnerabilities GHSA-4c29-8rgm-jvjj

### Impact When using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. ### Patches The issue has been fixed in v0.28.1+ ### Workarounds Issue requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.

View original source
Open Source Vulnerabilities CVE-2026-33747

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.

View original source

05 / REFERENCES

Further evidence