CVE-2026-44517

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44517
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44517.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44517
Aliases
Downstream
Related
Published
2026-08-21T20:29:00.354Z
Modified
2026-08-23T03:53:39.316546438Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVSS Calculator
Summary
Buildah: Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive
Details

Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A malicious server supplying a Git repository or tar archive can cause files outside the build context directory to be included in the context or copied into the build. This issue is fixed in versions 1.43.2 and 1.44.0.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44517.json"
}
References

Affected packages

Git / github.com/podman-container-tools/buildah

Affected ranges

Type
GIT
Repo
https://github.com/podman-container-tools/buildah
Events
Introduced
a07dde1b8d12cd35717aae96ecda38cb6911e9c3
Fixed
54459cf8a0feb4b1da766e4a6360451834e1846c
Fixed
fc2003bb2efeb3ed7d5c7e1e88d04e78f370a944
Fixed
d7efdbc845dcd816c7701c6352d6be233683f737
Fixed
30a4189415e5d0a3a0c5971307a6432d8ed1a097
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.38.1"
        },
        {
            "fixed": "1.43.2"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44517.json"