# CVE-2026-33748: BuildKit Git URL subdir component can cause access to restricted files

Source: https://junglewise.ai/threats/cve-2026-33748-buildkit-git-url-subdir-component-can-cause-access-to-restricted  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-27. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-33748 · Severity: high · CVSS 7.5 · Published 2026-03-27

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.

Technologies: [github.com/moby/buildkit (Go)](https://junglewise.ai/threats/technologies/github-com-moby-buildkit). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-33748 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33748 being exploited in the wild.

**How severe is CVE-2026-33748?** High severity, with a CVSS score of 7.5, published 27 March 2026.

**Which products and versions are affected?** github.com/moby/buildkit (Go) < 0.28.1, SEMVER:introduced=0,fixed=0.28.1.

**Is there a fix for CVE-2026-33748?** Yes. github.com/moby/buildkit (Go): upgrade to 0.28.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-33748?** Check whether you run github.com/moby/buildkit (Go) or Mobyproject Buildkit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/moby/buildkit (Go): upgrade to 0.28.1 or later

  ```sh
  go get github.com/moby/buildkit@v0.28.1
  ```


## Affected products

- github.com/moby/buildkit (Go) < 0.28.1, SEMVER:introduced=0,fixed=0.28.1
- Mobyproject Buildkit

## Identifiers

- CVE-2026-33748
- GHSA-4vrq-3vrq-g6gg
- GO-2026-4859

## References

- [https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg](https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg)
- [https://docs.docker.com/build/concepts/context/](https://docs.docker.com/build/concepts/context/)
- [https://github.com/moby/buildkit/releases/tag/v0.28.1](https://github.com/moby/buildkit/releases/tag/v0.28.1)
- [https://api.github.com/repos/moby/buildkit/security-advisories/GHSA-4vrq-3vrq-g6gg](https://api.github.com/repos/moby/buildkit/security-advisories/GHSA-4vrq-3vrq-g6gg)

## Related threats

- [Moby BuildKit denial of service via unbounded group parsing](https://junglewise.ai/threats/cve-2026-61712-moby-buildkit-denial-of-service-via-unbounded-group-parsing)
- [Moby BuildKit custom frontend security bypass](https://junglewise.ai/threats/cve-2026-61711-moby-buildkit-custom-frontend-security-bypass)
- [GO-2026-4858 - BuildKit's Malicious frontend can cause file escape outside of storage root in github.com/moby/buildkit](https://junglewise.ai/threats/cve-2026-33747-buildkit-s-malicious-frontend-can-cause-file-escape-outside-of)
- [GO-2024-2493 - Host system file access in github.com/moby/buildkit](https://junglewise.ai/threats/cve-2024-23651-buildkit-vulnerable-to-possible-race-condition-with-accessing)
- [GO-2024-2492 - Panic in github.com/moby/buildkit](https://junglewise.ai/threats/cve-2024-23650-buildkit-vulnerable-to-possible-panic-when-incorrect-parameters)