CVE-2026-33747 HIGH

CVE-2026-33747: BuildKit vulnerable to malicious frontend causing file escape outside of storage root

Vendor Moby
Product buildkit
Weakness CWE-22 · Path traversal
Published March 27, 2026
Last update March 27, 2026
View on NVD All CVEs

CVSS base score

8.4/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.

Key dates

02Disclosure timeline

March 27, 2026 CVE published
March 27, 2026 Record updated