CVE-2026-33748: BuildKit Git URL subdir component can cause access to restricted files
Impact Insufficient validation of Git URL fragment subdir components (<url>#<ref>:<subdir>, docs) may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem.
Patches The issue has been fixed in version v0.28.1
Workarounds The issue affects only builds that use Git URLs with a subpath component. Avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.
Other sources
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33748?
CVE-2026-33748 is considered a medium severity vulnerability due to insufficient validation of Git URL fragment subdir components.
How do I fix CVE-2026-33748?
To remediate CVE-2026-33748, upgrade to version 0.28.1 or later of the affected package from GitHub's buildkit.
What are the risks associated with CVE-2026-33748?
The risks involve potential unauthorized access to files outside the checked-out Git repository root, which may compromise sensitive information.
Which software is affected by CVE-2026-33748?
CVE-2026-33748 affects the buildkit package from GitHub with versions prior to 0.28.1.
Is there a workaround for CVE-2026-33748?
There are no specific workarounds for CVE-2026-33748, so upgrading to the fixed version is recommended.