PT-2026-61984 · Buildkit · Buildkit

Owais Lone · CVE-2026-15791 · Published 2026-07-21 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v4.0

1.8

Low

Base vector

AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions BuildKit (affected versions not specified)

Description A crafted message in the low-level build API allows an attacker to remove the contents of the /tmp directory. This occurs because an action intended to delete files within the build container rootfs can escape and affect the actual host temporary directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-15791

GHSA-32PV-7HQ5-QHWQ

Affected Products

Buildkit

References · 4

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15791.json · Exploit
• https://github.com/moby/buildkit/security/advisories/GHSA-32pv-7hq5-qhwq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-15791 · Security Note
• https://osv.dev/vulnerability/CVE-2026-15791 · Vendor Advisory