{"id":"CVE-2026-44517","title":"Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive","summary":"Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive","severity":"medium","cvss":6.3,"cwe":["CWE-22"],"vendor":"containers","product":"github.com/containers/buildah","ecosystem":"go","affected":["github.com/containers/buildah >= 1.38.1, < 1.43.2"],"patched":["github.com/containers/buildah 1.43.2"],"published":"2026-06-22","updated":"2026-06-22","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-49p4-px3h-rq49","references":[{"url":"https://github.com/containers/buildah/security/advisories/GHSA-49p4-px3h-rq49"},{"url":"https://github.com/podman-container-tools/buildah/security/advisories/GHSA-49p4-px3h-rq49"},{"url":"https://github.com/advisories/GHSA-49p4-px3h-rq49"}],"tags":["ghsa","go"],"ingestedAt":"2026-06-29T13:24:35.514Z","epss":0.0018,"epssPercentile":0.07762,"slug":"CVE-2026-44517","body":"## Overview\n\n### Impact\n\nWhen processing a build contexts or `add`/`copy` instructions, a malicious server serving a Git repository or a tar archive file can cause files outside of the build context directory to be included in the build context or copied into the build.\n\n### Patches\n\nFixed in Buildah 1.44 and 1.43.2.\n\n## Affected packages\n\n- `github.com/containers/buildah >= 1.38.1, < 1.43.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/containers/buildah 1.43.2`","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}