Executive brief
Buildah is a tool used to create container images. A security flaw allows a malicious server to trick the tool into including sensitive files from the host machine that were not intended to be part of the container. This could lead to the accidental exposure of private data or credentials during the image creation process.
Technical details
A path traversal vulnerability (CWE-22) exists in Buildah when processing build contexts or 'ADD'/'COPY' instructions. When a user performs a build using a malicious Git Smart HTTP server or a specially crafted GitHub release tar archive, the tool fails to properly restrict file access to the intended build directory. This allows an attacker to cause files from the host's filesystem, located outside the build context, to be included in the resulting container image. The vulnerability is exploited via local execution with user interaction (triggering a build from a malicious source) and has been patched in versions 1.43.2 and 1.44.
Affected products
- containers Buildah >= 1.38.1, < 1.43.2
Timeline
- 2026-06-12: disclosed: Initial disclosure by mheon
- 2026-06-22: advisory: GitHub Advisory published