Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive

GHSA-49p4-px3h-rq49 · CVE-2026-44517 · GO-2026-5116

Published Jun 22, 2026 · Modified Jul 27, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Impact

When processing a build contexts or add/copy instructions, a malicious server serving a Git repository or a tar archive file can cause files outside of the build context directory to be included in the build context or copied into the build.

Patches

Fixed in Buildah 1.44 and 1.43.2.

References

WEB https://github.com/containers/buildah/security/advisories/GHSA-49p4-px3h-rq49
WEB https://github.com/podman-container-tools/buildah/security/advisories/GHSA-49p4-px3h-rq49
PACKAGE https://github.com/podman-container-tools/buildah

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes