Directory Traversal Vulnerability in BuildKit by Moby
CVE-2026-75593

7.2HIGH

Key Information:

Vendor

Moby

Status
Buildkit
Vendor
CVE Published:
19 August 2026

What is CVE-2026-75593?

The BuildKit toolkit, utilized for converting source code to build artifacts, is affected by a vulnerability prior to version 0.31.2. This security flaw allows a custom client, possessing valid permissions to the BuildKit control API, to craft upload requests that can circumvent the intended confines of the BuildKit-controlled state directory. This results in files being able to escape from the designated directory, posing significant security risks. Users are advised to update to version 0.31.2 or later to mitigate this issue. For further details, consult the relevant security advisories.

Affected Version(s)

buildkit < 0.31.2

References

https://github.com/moby/buildkit/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/moby/buildkit/releases/tag/v0.31.2
x_refsource_MISC

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.