{"id":"CVE-2026-44517","sourceIdentifier":"security-advisories@github.com","published":"2026-08-21T21:16:59.250","lastModified":"2026-10-12T16:10:00.220","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A malicious server supplying a Git repository or tar archive can cause files outside the build context directory to be included in the context or copied into the build. This issue is fixed in versions 1.43.2 and 1.44.0."},{"lang":"es","value":"Buildah es una herramienta que facilita la creación de imágenes OCI. Desde la versión 1.38.1 hasta la 1.43.2 y la 1.44.0, TempDirForURL en define/types.go no confina de forma segura los subdirectorios del repositorio Git al contexto de construcción descargado, y downloadToDirectory y stdinToDirectory pueden seguir un enlace simbólico de Dockerfile dejado por un archivo tar parcialmente extraído. Un servidor malicioso que suministra un repositorio Git o un archivo tar puede hacer que los archivos fuera del directorio del contexto de construcción se incluyan en el contexto o se copien en la construcción. Este problema está corregido en las versiones 1.43.2 y 1.44.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"containers","product":"buildah","versions":[{"version":">= 1.38.1, < 1.43.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-25T17:05:33.478033Z","id":"CVE-2026-44517","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/podman-container-tools/buildah/commit/54459cf8a0feb4b1da766e4a6360451834e1846c","source":"security-advisories@github.com"},{"url":"https://github.com/podman-container-tools/buildah/commit/fc2003bb2efeb3ed7d5c7e1e88d04e78f370a944","source":"security-advisories@github.com"},{"url":"https://github.com/podman-container-tools/buildah/releases/tag/v1.43.2","source":"security-advisories@github.com"},{"url":"https://github.com/podman-container-tools/buildah/releases/tag/v1.44.0","source":"security-advisories@github.com"},{"url":"https://github.com/podman-container-tools/buildah/security/advisories/GHSA-49p4-px3h-rq49","source":"security-advisories@github.com"}]}