{"id":"GO-2026-5116","revision":"763ac0915d184e0fb353bec5a8608b43","records":[{"revision":"763ac0915d184e0fb353bec5a8608b43","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5116","aliases":["CVE-2026-44517","GHSA-49p4-px3h-rq49"],"title":"Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah","description":"Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation.","state":0,"publishedAt":"2026-07-27T15:30:50+00:00","modifiedAt":"2026-07-27T17:00:20.1085181+00:00","affected":[{"ecosystem":"Go","name":"github.com/containers/buildah","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.38.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/containers/buildah/security/advisories/GHSA-49p4-px3h-rq49"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5116","license":"OSV · upstream source license applies","key":"osv:GO-2026-5116","identifiers":["GO-2026-5116","CVE-2026-44517","GHSA-49p4-px3h-rq49"]},"retained":false,"historicalAffected":[]}],"coverage":[]}