PT-2026-28526 · Docker+3 · Buildkit+3

Published 2026-03-26 · Updated 2026-05-18 · CVE-2026-33748

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions BuildKit versions prior to 0.28.1

Description Insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. This issue affects builds that use Git URLs with a subpath component. The vulnerable component is the handling of the subdir component within Git URLs. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.

Recommendations Update to BuildKit version 0.28.1 or later. Avoid building Dockerfiles from untrusted sources. Avoid using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.

Exploit

Fix

Path traversal

Link Following

Weakness Enumeration

CWE-22

CWE-59

Related Identifiers

BDU:2026-07210

CLEANSTART-2026-FK40318

CLEANSTART-2026-HI89495

CVE-2026-33748

GHSA-4VRQ-3VRQ-G6GG

GO-2026-4859

OPENSUSE-SU-2026:10651-1

OPENSUSE-SU-2026:20702-1

OPENSUSE-SU-2026:20809-1

OPENSUSE-SU-2026:20814-1

SUSE-SU-2026:1205-1

SUSE-SU-2026:2120-1

SUSE-SU-2026:21851-1

USN-8230-1

Affected Products

Buildkit

Linuxmint

Red Os

Ubuntu

References · 132

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33748.json · Exploit
• https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32280 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10651-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34040 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-41089 · Security Note
• https://osv.dev/vulnerability/GO-2026-4859 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4vrq-3vrq-g6gg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23653 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-HI89495 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1205-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39882 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33748 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26054 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32283 · Security Note