---
id: CVE-2026-44517
title: >-
  Build breakout using malicious Containerfile and Git Smart HTTP server or
  GitHub release tar archive
summary: >-
  Build breakout using malicious Containerfile and Git Smart HTTP server or
  GitHub release tar archive
severity: medium
cvss: 6.3
cwe:
  - CWE-22
vendor: containers
product: github.com/containers/buildah
ecosystem: go
affected:
  - 'github.com/containers/buildah >= 1.38.1, < 1.43.2'
patched:
  - github.com/containers/buildah 1.43.2
published: '2026-06-22'
updated: '2026-06-22'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-49p4-px3h-rq49'
references:
  - url: >-
      https://github.com/containers/buildah/security/advisories/GHSA-49p4-px3h-rq49
  - url: >-
      https://github.com/podman-container-tools/buildah/security/advisories/GHSA-49p4-px3h-rq49
  - url: 'https://github.com/advisories/GHSA-49p4-px3h-rq49'
tags:
  - ghsa
  - go
ingestedAt: '2026-06-29T13:24:35.514Z'
epss: 0.0018
epssPercentile: 0.07775
---

## Overview

### Impact

When processing a build contexts or `add`/`copy` instructions, a malicious server serving a Git repository or a tar archive file can cause files outside of the build context directory to be included in the build context or copied into the build.

### Patches

Fixed in Buildah 1.44 and 1.43.2.

## Affected packages

- `github.com/containers/buildah >= 1.38.1, < 1.43.2`

## Remediation

Upgrade to a patched release:

- `github.com/containers/buildah 1.43.2`